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to  outside  audit,  ?1te  toireati  aays  that  it 
dev$E>ped  the  Carnivore  system  precisely 
to  attorns  the  ssme  privacy  concerns  that 
many  toton^t  providers  have,  FBItodmir 
asm  also  toe  tiled  to  recent  weeks  to 
explain  to  Industry  specialists  how  Carni- 
vore «Hta,  partly  to  silay  feats  that  the 
system  might  he  open  to  abuse . 

Still,  there  is  a drive  afoot  in  the  Inter- 
,Mt  Industry  to  create  a more  open  solu- 
tion that  could  replace  Carnivore,  Industry 
experts  argue  that  creating  their  own  de- 
vice would  Jesses  suspicions  and  allow  for 

dicker  modifications  as  Internet  proto* 
cats  change.  The  FBI  says  that  a small 
number  of  Internet  providers  already  have 
built-in  capacities  to  meet  federal  wiretap 
requests.  Carnivore  is  required  .for  those 
that  don’t  have  the  ability  to  do  the  wire- 
taps themselves, 

' * -Neil  King  Jr. 
contributed  to  this  article 

£!£&  l***™1^  Unk:  Ecad  an  'mm  hmfmg 
4^nil  and  joia  a discussion  about  privacy 
and  the  Internet  in  the  online  Journal 
at  WSheem, 
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Of  Privacy 

New  System  Tracks 
Suspects  Online 

Bf  JOHtf  $CKTOUft2 
gfohwgtan  Pott  Staff  IFritfr 

The  FBI  has  deployed  m mi& 
mated  syst  em  to  wiretap  the  Inter- 
net*  giving  authorities  a new  tool 
to  police  cyberspace  bat  drawing 
concerns  among  dvii  libertarians 
and  privacy  advocates  about  how  it 
might  be  used. 

The  new  computer  system, 
dubbed  "Carnivore"  inside  the  FBI 
because  it  rapidly  finds  the  "meal" 
is  vast  amountsof  data*  was  devel- 
oped at  FBI  computer  labs  m 
Quant ico,  V&.,  and  has  been  used 
in  fewer  than  50  cases  so  far, 
i But  that  number  is  sure  to  rise, 

I said  Marcus  Thomas*  chief  of  the 
; FBfs  ober-tedmology  section  at 

j Quajntico.  "In  criminal  situations' 

there's  not  yet  been  a large  call  for 
>C  he  said,  but  the  bureau  already 
has  seen  "growth  in  the  rate  of  re- 
quests," 

Civil  liberties  groups’  said  the 
new  system  raises  troubling  issues 
\ about  what  constitutes  a reason- 
able search  an  d seizure  of  electron' 
ic  data.  In  smiting  out  potential 
criminal  conduct*  the  new  tecbnol- . 
ogy  also  could  scan  private  in- 
formation  about  legal  activities, 

*Tt  goes  to  theriieart  of  how  the 
Fourth  Amendment  and  the  feder- 
al wiretap  statute  are  going  to  be 
allied  m the  Internet  age**  said 
Marc  Rotenberg*  head  of  the 
Washington-based  Electronic  Pri- 
vacy Information  Center. 
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The  new  system*  which  operates  on  off- 
the-shelf  personal  computers,  takes  ad- 
vantage of  one  of  the  fundamental  princi- 
ples of  the  Internet  that  virtually  all  such 
communications  are  broken  up  Into  "pack- 
ets," or  uniform  chunks  of  data.  Computers 
on  the  Internet  break  tip  e-maH  messages. 
World  Wide  Web  rite  traffic  and  other  in- 
formation into  pieces  and  route  the  packets 
across  the  network*- whm  tbev  are 
reassembled  os  the  other  end  . 

FBI  programmers  devised  a "packet  snift- 
er* system  that  can  analyze  data  Sowing 
through  computer  networks  to  determine 
whether  it  is  part  of  an  e-mail  message  or 
some  other  piece  of  Web  traffic. 

The  ability  to  distinguish  between  pack- 
ets rilows  law  enforcement  officials  to  tailor 
their  searches  so  that*  for  example*  they  can 
exarmae  email  but  leave  alone  a suspect's 
online  shopping  activities.  The  system 


could  be  tuned  to  do  as  little  as  monitoring 
hm  many  e-mail  messages  the  suspect 
s^nds  and  to  whom  they  arc  addressed — 
the  equivalent  of  t telephone  "pen  register  * 
which  takes  down  telephone  numbers  being 
called  without  grabbing  the  content  of  those 
calls, 

"Thaf$  the  good  news**  said  James 
Dempsey  an  analyst  with  the  Center  for  Do-  - 
moeracy  and  Technology;  a Washington 
high-tech  policy  group.  "It  is  a more  dis- 
criminating device"  than  a full  wiretap*  he 
said. 

But  Dempsey  expressed  worries  about 
the  new  system*  which  would  be  installed  al 
the  offices  of  a suspect's  Internet  service 
provider.  Just  as  the  device  could  be  used  to  ■ 
fine-tune  a search*  it  also  could  used  for 
broad  sweeps  of  data.  The  bad  news  Is  that 
Itfs  a black  box  the  government  wants  to  in- 
sert into  the  premises  of  a service  provider. 
Nobody  knows  that  it  does  what  five  govern- 
merit  claims  it  would  do  * Dempsey  said.* 


Existence  of  the  Carnivore  system  was 
discussed  in  a Wall  Street  Journal  article 
yesterday,  which  reported  that  the  FBI 
showed  the  system  to  triecommunications 
industry  experts  two  weeks  ago. 

Albert  Gidari  a lawyer  who  works  for  the 
wireless  industry,  was  present  at  the  FBI 
demonstration.  He  said  the  FBfs  announce- 
men!  was  {Mended  to  counter  industry  as- 
sertions that  it  would  be  very  difficult  to 
provide  the  kind  of  penregister  wiretap  ca-  : 
pab&tythat  the  agency  wants. 

Since  the  demonstration*  Gidari  said*  one 
faction  within  the  fe&communkatfons  m- 
dustjy  was  pteed  with  the  FBTs  e gbits. 
But  Gidari  said  the  other  faction  was  say- 
i mg.  "Writ  a mfoute-~wbat  are  the  liability 
Issues?  What  am  the  privacy  issues?  We 
don't  want  thijd-party  software  on  our  sys- 
tem.* > ' ' 


wiretap.  Gidari  ts  one  of  a large  number  of 
industry  experts  who  believe  the  hw  does 
apply  to  wiretapping  the  Internet  "The 
FBI  overreaches  In  everything  they  do  * 
said  Gidari,  who  is  president  of  G-Sawy,  an 
iMenietconsdtmgcompany 
A former  federal  prosecutor  sounded  a 
more  supportive  tone. Tf  what  It  does  is  it 
hefps  comply  with  wiretaps*  and  it  helps 
nunlmbe  what  you're  getfing-Ho  help  get 
what  .the  court  authorises  you  to  get— 
{here’S  BOthing  wrong  with  fC  said  Mark 
Easch,  now  a security  consultant  with  Ee$- 
toa-based  Global  Integrity, 

SiSl*  Easdi  said  the  technology  raised 
questions  that  have  yet  to  be  fidiy  explored 
by  law  enforcement  The  PC  robooop  exam- 
ines all  packets  commg  through  a computer 
network  but  gives  five  law  enforcement  offi- 
only  those  packets  related  to  the  sub- 
let of  the  investigation 
"The  stuff  that  is  examined  only  by"  a 
computer  md  not  by  a human  befog— was 


m then  .suggested  an  answer:  It  is  & 
^arch,  but  it  is  to  m extent  less  fovarive" 
than  it  would  be  it  you  did  not  use  this  tech: 
oology. 

. |he  first  news  of  Carnivore  actually  came* 
m April  during  congressional  testimony  by' 
Washington  lawyer  Robert  Cons-Rever* 
^ho  represented  an  Internet  service  proyfo- 
er  that  toed  to  resist  attaching  the  system 
to  its  network.  Com -Revere  suggested  that 
such  a system  could  be  used  to  track  dis^4 

SJudlLs  Sfin  ... 
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requiring  telephone  companies  to  make  / 
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Justice,  on  Both  Sides  of  the  Border 


Agustm  Vazquez  Mendoza  landed  on  the 
FBI  s 10  most  wanted  list  four  years  ago  for 
allegedly  ordering  Ms  henchmen  to  kill  a 
Drug  Enforcement  Administration  agent  in 
Anzona,  Now  he’s  under  arrest,  but  in 
Mexico,  which  roust  decide  whether  to  extra- 
dite a Mexican  citizen  to  face  charges  in  the 
United  States.  Mexican  law  officers  rooanted 
a nationwide  manhunt  to  capture  Vazquez 
and  certainly  want  him  brought  to  justice, 
but  some  traffickers  have  won  appeals 
against  extradition. 

Most  countries  are  understandably  reluc- 
tant to  hand  over  a citizen  to  be  tried  in  a for- 
eign country.  In  addition,  the  language  in  the 
current  Mexico-U.S.  treaties  clearly  specifies 
that  neither  country  is  bound  to  extradite  a 
citizen.  However,  there  are  circumstances  in 
the  Vazquez  case  that  should  make  it  easier 
for  Mexico  to  send  him  off. 


^Since  President  Ernesto  Zedillo  took  office, 
there  has  teen  a shift  of  attitude  in  Mexico 
on  extradition.  At  least  nine  Mexican  sus- 
pects have  teen  sent  to  be  tried  in  the  United 
States.  In  two  of  those  cases,  the  suspects  al- 
legedly killed  US.  immigration  officials,  in- 
viting comparison  with  the  Vazquez  case. 

According  to  US.  authorities,  Vazquez  or*  j 
dered  the  murder  of  agent  Richard  Pass  in  ’ 
order  to  keep  both  a drug  delivery  and  the 
$160,000  the  undercover  agent  was  about  to 
pay  for  it. 

Perhaps  the  most  persuasive  argument  is 
that  Vazquez,  who  fled  to  Mexico  after  the 
mitag,  is  not  accused  of  a crime  in  Mexico 
and  if  he  is  not  extradited  will  have  to  be  set 
free.  Mexico's  foreign  minister  should  con- 
sent to  the  U.S.  extradition  request  and  peti-  ■ 
tion  the  justice  system  to  send  him  north  as  ] 
qyjcicly  as  the  legal  process  sJlows,  f 


n 
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It  Won’t  Install 
Device  for  FBI 


One  of  the  nation's  largest  Imeraet  ser- 
vice providers,  EmhUnk  I«c.(  has  re- 
fysed  10  install  a new  Federal  Bureau  of 
Investigation  electronic  surveillance  de- 
?*»  on  lts  saying  technical  ad- 

justments required  to  use  the  device 
caused  disruptions  for  customers. 

The  FBI  has  used  Carnivore,  as  the 
sumiilanee  device  is  called,  in  a number 
of  criminal  investigations.  But  EartfcUnfc 
is  the  first  ISP  to  offer  a public  account  of 


Bp  Wajj  Street  Journal  staff  reporters 
htm  llmgfield,  Ted  Bridis  and  Nml 
King  Jr, 


an  actual  experience  with  Carnivore.  The 
FBt  has  daimed  that  Carnivore  won't  in- 
ter/efe  with  m ISP's  operations. 

"It  has  the  potential  to  hurt  our  net- 
work,  to  bring  pieces  of  it  dowtij  Steve 
Dougherty.  Earthlink's  director  of  technol- 
ogy acquisition,  said  of  Carnivore  “It 
could  impact  thousands  of  peopled 

Earth  Link  executives  said  they 
would  continue  to  work  with  authorities  In 
cnmmal  investigations,  they  vowed  not  to 
allow  the  FBI  to  install  Carnivore  on  the 
company's  network.  The  company  also 
has  substantial  privacy  concerns. 

Earthlink  has  already  voiced  its  con- 
cerns in  court.  The  ISP  h the  plaintiff  in  a 
“***  fight  launched  a gainst  Carnivore  ear- 
tj]1*  Tear  with  the  help  of  attorney 
Robert  Com -Revere,  according  to  people 
close  to  the  case.  Previously,  the  identity 
of  the  plaintiff  m the  case,  which  Is  under 
seal  wasn't  known,  a federal  magistrate 
rtded  against  EarthUnk  in  the  case  early 
this  year,  forcing  it  to  give  the  FBI  access 
to  us  system.  Mr.  Corn-Re  vere  declined  to 
comment. 

EanhLmk's  problems  with  Carnivore 
feMriier  this  year'  when  me  FBI  in- 
? a“td  * ******  device  on  in  rtm-ort 
at  a hub  site  m PasatJena,  CaSM.  The  FBi 
had  a court  order  that  aitowed  it  to  ijistail 
m equipment  as  part  of  a criminal  invest 
gation. 


The  FBI  connected  Carnivore,  & small 
computer  box  loaded  with  sophisticated 
software  for  monitoring  e-mail  and  other 
online  communications,  to  EarthUnk's  re- 
mote access  servers,  a set  of  networking 
equipment  that  answers  Incoming  modem 
calls  ^ from  customers.  But  Carnivore 
wasn't  compatible  with  the  operating  sys- 
tem software  on  the  remote  access  serv- 
ers. So  Earthlink  had  to  install  an  older 
version  of  the  system  software  that  would 
work  with  Carnivore,  according  to  Mr* 
Dougherty 

EarihLtnk  says  the  older  version  of  the 

software  caused  Its  remote  access  servers 
to  crash,  which  in  turn  knocked  out  access 
for  s number  of  its  customers,  Mr,  Dough- 
erty declined  to  specify  how  many,  saying 
only  that  *many*  people  were  affected. 

Earthlink  executives  said  they  were 
also  concerned  about  privacy.  The  com- 
pany said  It  had  no  way  of  knowing 
whether  Carnivore  was  limiting  its  surveil- 
lance to  the  criminal  investigation  at 
hand,  or  was  trolling  more  broadly.  Other 
fSF^  have  said  there  could  be  serious  liabil- 
ity issues  for  them  if  the  privacy  ofindhid- 
uals  not  connected  to  an  investigation  is 
compromised. 

There  ought  to  be  some  transparency 
to  the  methods  and  tools  that  law  enforce- 
menus  using  to  se&rch-and-seise  commu- 
nications,” said  John  ft  I^Galbo,  rice 
president  of  public  policy  at  PSLNet  Inc. 
an  ISP  in  Ashburn,  Va, 

EarthXink  executives  declined  to  sav 
whether  the  company  has  received  court 
jrders  for  infonMfto^bou^oiher  custom- 


eis  since  the  disruption  earlier  this  year, 
Earf  blank  said  it  would  help  authorities  in 
criminal  investigations  using  techniques 
other  than  Carnivore,  . ‘ 1 ‘ " 

The  FBI  insists  that  Carnivore  doesn't 
affect  the  performance  or  stability  of  an 
Internet  provider's  existing  networks.  The 
bureau  says  Carnivore  passively  monitors 
traffic,  recording  only  information  that  Is 
relent  to  FBI  investigations. 

In  some  cases,  the  FBI  said,  the  Inter- 
net prorider  is  equipped  to  turn  over  data 
without  the  use  of  Carnivore,  This  is  com- 
mon In  cases  where  only  e-mail  messages 
are  sought  because  that  type  of  data  can 
easily  be  obtained  through  Jess-intrusive 
means. 

Attorney  Genera!  Janet  Reno  said  yes- 
terday that  she  was  putting  the  system 
under  review.  She  said  the  Justice  Depart- 
ment would  investigate  Carnivore's  consti- 
tutional implications  and  make  sure  that 
the  FBI  was  using  It  In  "a  consistent  and 
balanced  way." 
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White  House  Proposes  Wiretap  Law 

ay  KALPANA  SR1N1VASAH 
rrn  Associmd  Prms 

WASHINGTON  (July  17)  - The  White  House  proposed  legislation  Monday  to  update  wiretapping  rules  so  that  legal  protections 
currently  applied  to  telephone  calls  are  extended  to  electronic  communication,  such  as  email 

The  plan  would  require  law  enforcement  officials  to  obtain  high-level  approval  before  applying  for  a court  order  to  intercept  the 
content  of  e-mail  * in  line  with  current  rules  that  govern  listening  to  phone  calls* 

/ 

"Basically.  the  same  communication,  if  sent  different  ways  * through  a phone  caif  ora  dial-up  modem  - is  subject  to  different  and 
inconsistent  privacy  standards,”  said  White  House  Chief  of  Staff  John  Podesta,  in  announcing  the  proposals,  “it's  time  to  update 
and  harmonize  our  existing  laws  to  give  ail  forms  of  technology  the  same  legislative  protections  as  our  telephone  cassations.*' 

The  measure  also  addresses  so-called  "trap  and  trace*  orders  which  allow  taw  enforcement  officials  to  identify  the  source  of  a 
phone  call  or  an  e-mal,  but  not  intercept  its  content.  Under  the  proposal,  law  enforcement  officials  would  only  need  one  order  to 
trace  an  e-mail  or  a phone  cadi,  even  though  such  communications  may  travel  through  multiple  phone  carriers  or  internet 
providers. 

Officials  also  could  trace  such  communications  without  prior  approval  in  an  emergency  situation,  such  as  when  a computer  is 
under  attacK. 

But  for  the  first  time,  the  administration  is  proposing  that  a federal  or  state  judge  independently  determine  whether  the  facts 
support  such  a trace  order.  Under  current  roles,  judges  accept  the  declaration  of  law  enforcement  officials  agencies  that  such  an 
order  is  warranted. 
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Those  changes  could  affect  the  new  “Carnivore*  system,  which  the  FB!  is  using  to  obtain  e-mails  of  investigative  subjects  after 
qettlng  a search  warrant.  Whan  Carnivore  is  placed  at  an  Internet  service  provider,  it  scans  all  incoming  and  outgoing  e-mails  for 
messages  associated  with  the  target  of  a criminal  probe. 

Under  the  proposed  changes,  if  the  Carnivora  system  is  being  used  to  intercept  the  content  of  electronic  communications,  then 
law  enforcement  officials  would  first  need  high-level  Justice  Department  approval  before  obtaining  a court  order,  Podesta  said. 
Higher  standards  limiting  its  use  also  would  apply,  he  said*  If  Csmhore  is  being  used  only  to  track  Information;  officials  would 
need  m independent  judge  to  review  the  tracing  order,  he  added. 


-But  the  American  Civil  liberties  Union  chided  the  administration's  proposals  Monday,  saying  It  should  have  suspended  use  of  the 
system  outright 

"Carnivore  represents  >3  grave  threat  to  the  privacy  of  all  Americans  by  gmng  Jaw  enforcement  agencies  unsupemsed  access  to 
a nearly  unlimited  amount  of  communications  traffic,*  said  Barry  SteinharriL  ACLU  associate  director/ 

Last  week,  ACLU  officials  said  they  were  going  to  use  the  Freedom  of  Information  Act  to  try  to  force  the  FBI  to  disclose  details  of 
the  inner  workings  of  Carnivore,  - 

The  proposed  measures  would  also  address  inconsistencies  in  how  current  law  applies  to  different  networks  carrying  Internet 
traffic.  For  example,  now  that  cable  systems  are  being  upgraded  to  offer  two-way  services,  taws  that  apply  to  dial-up  modems 
over  phone  Unas  should  be  extended  to  cable  connections*  Podesta  said. 

The  proposal  requires  congressional  approval,  and  several  lawmakers  already  introduced  their  own  versions* 


Hie  Clinton  administration  also  announced  Monday  updates  to  its  export  control  policy  for  powerful  data  and  voice-scrambling 
technology*  Under  the  change,  American  companies  can  sell  encryption  products  to  any  end  user  in  the  European  Union  or 
these  eight  other  trading  partners:  Australia,  Norway,  Czech  Republic,  Hungary,  Poland,  Japan,  New  Zealand  and  Switzerland. 

The  policy  change  wit!  also  remove  a previous  technical  review  waiting  period  of  30  days*  ^ 5 
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ACLU  Asks  Details 
On  FBFs  New  Plan 
To  Monitor  the  Web 


By  Nick  Wingfield 

Staff  Reporter  *yf  Tm  Wau.  Street  Jmttt* al 

The  American  Civil  Liberties  Union  ts 
seeking  to  force  the  Federal  Bureau  ofim 
Ycstigatta  to  disclose  the  technical  details 
behind  a controversial  electronic  somih 
lance  system  created  by  the  bureau. 

The  ACLU,  using  a novel  tactic  to  Hen- 
hfy  the  monitoring  capabilities  of  the  sys- 
tem, filed  a Freedom  of  Information  Act 
Hjquest  with  the  FBI  Friday,  asking  the 
bureau  to  release  the  computer  “source 
code"  for  Carnivore,  as  the  surveillance 
' system  is  called.  The  civiMiberties  group 
also  requested  that  the  FBI  turn  over  ’let- 
ters, correspondence,  tape  recordings, 
notes,  data*  memoranda,  e-mair  and 
other  information  connected  with  Carnh 
Tore,  The  ACLU  also  ashed  for  informa- 
non  related  to  Omnivore  and  EtherPeek, 
tu^o  other  surveillance  systems  used  in  the 
past  by  the  bureau. 

The  request  reflects  the  growing  con- 
cern among  privacy  groups  and  Internet 
companies  about  the  privacy  implications 
of  Carnivore*  The  FBI  surveillance  $ys- 
tern,  a hardware  device  that  contains  a 
specialised  program  for  tracking  e-mail 
and  other  forms  of  online  communication 
has  especially  raised  hackles  among  Inter' 
net  service  providers*  The  FBI  is  attempt- 
mgto  install  Carnivore  on  the  networks  of 
ISPs  as  part  of  specific  criminal  investiga- 
tions of  online  men.  But  ISPs  say  they 
have  no  way  of  knowing  whether  Carni- 
vore is  limiting  the  scope  of  its  surveil- 
lance to  the  cases  at  hand. 

As  a result;  critics  of  Carnivore  have 
called  on  the  government  to  reveal  the 


technical  capabilities  of  the  system.  Such 
information  could  indicate  whether  Carni- 
vore is  able  to  restrict  its  monitoring  to 
the  communications  ofi  say  a single  crimi- 
nal suspect  while  Ignoring  other  data  traf- 
fic irrelevant  to  the  investigation* 

The  source  code  behind  Carnivore 
could  provide  clues  to  those  capabilities. 
Source  code  is  essentially  the  technical 
blueprint  behind  a program.  The  ACLU 
contends* , and  technical  experts  con- 
curred, that  examining  the  source  code 
behind  Carnivore's  proprietary  surveil- 
lance software  could  reveal  something  of 
the  inner  workings  of  the  system. 

The  Electronic  Privacy  Information 
Center,  a Washington  advocacy  group,  last 
week  also  filed  a sweeping  Freedom  of 
Information  request  for  "all  records"  relat- 
ing to  Carnivore*  though  it  didnV  explic- 
itly request  the  system’s  source  code*  “But 
we  made  clear  we  are  seeking  everything 
including  software,"  said  David  Sobol,  a 
privacy  activist  at  the  center. 

If  is  unclear  whether  using  the  Free- 
dom of  Information  Act  will  compel  the 
FBI  to  produce  the  software  behind  Carni- 
vore though.  Bequests  made  under  the  act 
are  normally  used  to  obtain  official  govern- 
ment documents,  not  software  code*  Barry 
SteJnhardL  associate  director  of  the 
ACLU,  said  two  federal  appeals-court  rub 
ings  that  classified  software  code  as  a 
form  of  speech  could  help  his  case, 

**  ail  but  certain  they  win  mi  want 
to  release  any  information  on  Carnivore, 
and  we  will  probably  have  to  fight  this  in 
the  courts/  Mr,  Sfeinhardt  said  of  the 
FBL  “But  we  think  this  is  worth  fighting 
for* 

The  FBI  didn't  return  calls  seeking 
comment  on  the  Freedom  of  Information 
request 

As  the  outcry  against  Carnivore  has 
escalated,  some  prominent  figures  in  the 
Internet  industry  have  expressed  a some- 
what more  sympathetic  view  towaid  the 
FBL  Vint  Cerft  who  has  been  dubbed  the 
"father  of  the  Internet**  for  his  develop- 


ment of  the  early  technical  foundations  of 
the  network,  said  it  is  "understandable 
that  law-enforcement  agencies  feel 
pressed  to  develop  methods  to  observe  In- 
ternet traffic  for  the  same  reasons  they 
have  fell  compelled  fo  find  ways  to  listen 
to  certain  telephone  conversations/ 

a-matl  message, 
added  that  such  modern  surveillance  teefr 
mques  need  to  be  balanced  "against  poten- 
tially abusive  practices  that  could  seri- 
ously erode  personal  privacy" 

-Nett  King  Jn 
contributed  to  this  article. 

Coca-Cola  FUes  to  Have 
Second  Race-Bias  Suit 
Moved  to  Federal  Court 

By  a Wau,  Street  Journal  Staff  Reporter 

ATLANTA-- Coca-Cola  Co.,  in  the  pro- 
cess of  settling  a class-action  race-discrim- 
ination lawsuit,  has  filed  a motion  to  move 
a second,  $1,5  billion  race-bias  suit  to  fed- 
eral from  state  court 

The  soft-drfnXeompsDyaitued  in  a mo- 
tion hied  Friday  that  most  of  the  claims  in 
the  lawsuit,  filed  last  month  on  behalf  of 
four  female  black  Coke  employees  by 
Willie  S.  Gary  and  Johnnie  Cochran,  in- 
' volve  federal  laws. 

But  a lawyer  on  Mr,  Gary’s  team,  Tri- 
da  CX  Hoffler,  disagreed  and  said  Mr. 
Gary  would  file  a motion  this  week  fo  keep 
the  cise  in  state  court.  Mr.  Gary,  a per- 
aortal-injury  attorney,  generally  brings  his 
cases  to  state  courts  and  has  said  he  pre- 
fers that  venue. 

The  lawsuit  filed  by  Mr.  Gary  claims  a 
variety  of  form  of  discrimination,  includ- 
ing negligent  hiring,  intentional  inSietion 
of  emotional  harm  and  hostile  work  envi- 
ronment, Coke  has  called  Mr.  Gary  an  op- 
portnnlsf  and  denied  the  charges. 
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The  Clinton  administration  yes- 
terday called  tor  updating  wiretap 
ping  laws  to  extend  the  powers  of 
law  agreement  to  the  online  world 
while  providing  new  legal  protec* 
lions  for  electronic  communication. 

Administration  officials  also  an* 
flounced,  as  expected,  a plan  to  loos* 
en  controls  on  the  export  of  encryp- 
tion aoftwam— the  programs  that 
help  Internet  users  scramble  mes- 
sages  and  data  to  protect  them  horn 
prying  eyes. 

On  the  wiretapping  issue.  White 
House  chief  of  staff  John  0.  Pode- 
sta,  in  a speech  at  the  National  Press 
Club,  described  the  coming  legisla- 
tive package  as  seeking  to  eliminate 
confusion  about  the  level  of  legal 
protection  for  various  forms  of  com- 
munication. 

Telephone  conversations  get  fair- 
ly strong, protection  tom  federal ; 
wiretaps  under  the  1968  Crime  Pa- 
trol and  Safe  Streets  Act  which  re- 
: quired  a court  order  and  high-level 
Justice  Department  approval  Wire* 
tape  rules  for  e-mail  sent  by  dial-up 
modem  are  covered  by  the  Electron* 

| tc  Communications  Privacy  Act-  of: 
1986,  That  law  might  not  cover  e- 
mail  sent  by  high-speed  cable  mo- 
dem, and  cable  companies  have  ar- 
gued that  their  online  services 
1 should  be  given  extremely  high  pro- 1 

tection  from  government  sumH-- 
lance  under  the  Cable  Act . 

*lt*s  time  to  update  and  harmo- 
nise our  existing  laws  to  give  all 
forms  of  technology  the  same  legist ; 
lathee  protections  as  our  telephone 
conversations^  Podesta  said.  , 

lawmakers  said  they  welcome 
the  opportunity  to  work  with  the  ad- 
ministration  on  these  issues, Sen. 
Orrin  G*  Hatch  (fcUtah)*  who  has 
introduced  an  Internet  privacy  bill, 
said:  "It  is  imperative  that  we  bal- 
ance the  interests  of  law  enforce- 
ment with  the  privacy  rights  of  the 


American  people*  We  must  ensure  tliat  appropriate 
checks  are  in  place  where  the  government  accesses  pri- 
vate communications  of  Americans,'’ 

Hotiestasaid  the  bills  making  up  the  package  would  be 
unveiled  within  10  days,  and  that  he  hopes  the  legisla- 
tion can  be  passed  by  the  end  of  the  year, 

Podesta  also  spoke  about  the  new  surveillance  tech- 
nology known  as  Carnivore,  wltich  gives  law  enforce* 
meat  authorities  the  ability  to  selectively  monitor  the 
Internet  traffic  of  individuals,  similar  to  the  devices  that 
can  record  the  telephone  numbers  of  calls  made  and  re- 
ceived by  a suspect  Unlike  M-Oedged  wiretaps,  Hie  ju- 
dicial oversight  of  such  surveillance  is  slight,  and  the 
protection  against  abuses  of  the  technology  by  law  en- 
forcement is  weak,  Fodesla  called  for  greater  judicial  , 
oversight 

lire  Podesfa  speech  ms  not  well  received  by  end  lib- 
erties advocates,  who  have  fought  Carnivore  and  other . 
administration  attempts  to  expand  wbetappmg  capabil- 
ities on  the  Internet  Barry  Stemhardt*  associate  direc- 
tor of  the  American  Civil  Liberties  Union,  called  the 
speech  "deeply  disappointing, . . . While  the  Clinton  ad- 


ministration's proposals  have  some  heartening  qua1 
to  them,  they  are  too  little  and  too  late  * with  too 
time  In  tire  legislati  ve  session  to  pass  new  hills.  The 
nivrire  system,  Steinhaxdt  said,  ^represents  a j 
threat  to  the  privacy  of  all  Americans  by  giving  la 
forcement  agencies  unsupervised  access  to  a nearly 
limited  amount  of  communications  traffic,* 

Podesta  also  discussed  the  new  encryption 
which  the  administration  can  implement  Imme 
Under  the  plan,  US,  companies  wil  be  able  to  expor 
. pMsticated  cryptography  products  to  users  in  an 
tion  in  the  European  Union  and  to  Australia,  Noi 
the  Czech  Republic,  Hungary,  Poland,  Japan,  New 
land ’and  Switzerland  The  government  will  elimi 
Hie  statutory  Stiday  waiting  period  before  mieh  exf 
cm  tajse  0ace  but  wH  keep  in  place  a requirement 
new  ledmologses  be  submitted.to  the  government  3 
technical  review. 

Encryption  has  been  a high-tech  battlefield  fee 
early  days  of  the  Clinton  administration,  Few  tec 
gies  are  as  important  in  the  fight  to  maintain  pens 
and  business  privacy;  but  few  technologies  present  < 
daunting  issues  for  law  enforcement  officials  fiJkeFB 
rector  Louis  X Freeh,  who  often  warps  that  crirni 
and  terrorists  can  use  “crypto*  to  cloak  their  plans 
activities.  High-tech  companies  snccessftiSy  argued 
US,  restrictions  harmed  only  American  compa 
since  (mrsemMms  ^ere  successfully  jmrketingst 
encryption  products;  and  in' January  the  Clinton  ad 
stratum  reduced  controls  on  encryption  exports, 

“The  reducing  of  these  regulations,  will  certain! 
low  US.  software  makers  to  compete  in  the  global 
ketplace,*  said  Robert  Hofieyman,  the  chief  exeeuti 
the  Business  Soft  ware  Alliance, 
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By  Billies  UKJtKmviTX 

On  Monday  the  White  House  proposed 
new  legislation  regulating  surveillance  by 
law  enforcement  agencies  on  the  Internet 
Sut civil  libertarians  are  already  complain* 
lag  that  this  plan  does  little  to  address  the 
problems  ostensibly  raised  by  Carnivore, 
the  FBI's  new  software  system  for  perform- 
ing comt^rdered  wiretaps  at  Internet  ser- 
vice providers  (ISPS). 

Using  a laptop  computer,  law  enforce- 
ment officials  can  hook  Carnivore  into  an 
ISP's  network.  Once  Installed*  it  reads  the 
headers  of  each  e-mail  message —listing 
the  sender*  recipient  and  subject  of  the 
mes$age-as  it  passes  through.  If  the 
sender  or  recipient  is  the  target  of  a tap. 
Carnivore  records  the  message. 

Rights  at  Risk? 

Here's  the  rub:  Before  Carnivore  can 
know  whether  * message  belongs  to  a tar- 
geted party,  it  must  browse  the  headers  of 
all  the  messages  passing  through  the  JSR 
With  a traditional  phone  tap,  law  enforce' 
meat  officers  only  listened  to  the  tele- 
phone line  that  the  subject  of  the  tap  was 
using.  The  ACLU  and  other  critics  com- 
plain that  when  Carnivore  reads  the  head' 
ers  of  anyone  who  Is  not  a target  it  no- 
dates their  rights. 

| The  ACLU-  and  other  Carnivore  critics 
peed  to  get  a grip -and  a hatter  under- 
standing of  the  new  technology. 

L Unlike  old-fashioned  analog  telephone 
pBs,  e-mail  messages  are  transmitted  dig- 
plly.  A computer  slices  and  dices  the  mes- 
sage Into  packets,  each  with  an  identify- 
£S;  tag*  . The  packets  then  spread  out 
throughout  the  Internet,  finding  the  most 
dpcient  path  to  the  destination  When 
they  arrive,  they  are  reassembled,  and  the 
t^>ient  gets  the  message.  As  a result, 
with  ^mad,  you  cannot  *tap  a Mae*  be- 
ram- often  there  ist  Uteblly,  no  parheu- 
^ you  can  do  is  scan  the 

known  to  use-iike.  his  ISP-and 
^ belong  to  him, 
Unats  wtiat  Carnivore  does. 


flats.  But 
use— a 

T^^acus^|(6te  to  FBI: 

15  < 


These  kinds  of  flaps  are  happening 
more  and  more  often.  Uixi  April  some  pri- 
vacy advocates  complained  when  the  FBI 
requested  SIS  million  for  "Digital  Storm," 
a program  for  monitoring  telephone  calls 
and  analyzing  recordings.  In  September,  a 
programmer  in  North  Carolina  found  the 
notation  "NSA  Key”  in  a Microsoft  soft- 
ware patch.  Soon  rumors  bounced  through 
the  Internet  claiming  Windows  had  a back 
door  that  allows  the  National  -Security 
Aaency  to  monitor  your  computer,  (Mi- 
crosoft explai  ned  Shat  the  tag  merely  signi- 
fied that  the  .software  complied  with  the 
agency's  security  standards,) 

The  granddaddy  of  all  bogus  fears, 
though,  is  Echelon,  If  you  believe  some 
European  Union  parliamentarians,  the 
United  States  and  Britain  operate  an  inter- 
national network  that  monitors  virtually  • 
all  commtmicatlons,  and  extract  choice  f 
nuggets  with  powerful  computers  that  rec- 
ognize key  phrases  in  messages  like  *as- 
sasrinatfon,*  “terrorist  attack”  or  “indus- 
trial secret,” 

In  reality,  it's  not  easy  to  find  a specific 
message  in  a flood  of  free-flowing  digitel  i 
data.  That's  the  whole  reason  for  getting  a I 
court  order  for  a wire  tap.  If  you  cannot  I 
hook  m&M mM** 
searching  to  find  the  message  you  want  to 
intercept. 

That  is  also  why  the  European  cam- 
paign against  Echelon  is  so  quixotic.  True, 
the  folks  at  NSA  Intercept  communications 
and  they  have  powerful  computers  and  in- 
genious software  that  helps  with  the  pro- 
cessing. But  it  is  impossible  for  even  the 
best  computer  system  to  routinely  sort 
through  all  of  the  world's  telecommimiet' 
tions  and  pull  out  telltale  messages,  as  the 
Echelon  paranoids  would  have  you  be- 
lieve. 

Usually  you  need 
to  know  what  you  are 
looking  for  and 
where  foe  message 
might  appear  before 
you  have  much  of  a 
chance  of  findiartt 
Also,  foe  cases  in 
which  one  message, 
tells  a .whole  story, 
are  rare.  Good  law 
enforcement  and  In- 
telligence usuahyre- 
quires  ; multipie  v 
sources  and . collat- 
eral Mprinabonfto 
makeien^-bfMSh- 

rev^^psl^pgt 


for  our  law  enforce- 
ment and  mteilh 
ffeuce  organizations 
to  listen  in  on  com- 

o!d  *&  >r  coum  tapTSSSij1* 

caDtor'frfi  riM  l!SmUCh  more  <WficuK  to 
capture  digital  messages  (hat  pass  over 

fiber  optics  or  bounce  through  cellular  net- 
w»rte  And.  with  strong  encryption  soft- 
ware freely  available  world-wide  anvone 
really  determined  to  keep  a message  se- 
cret  can  usually  do  so. 

If  you  have  any  doubts,  just  recall  bow 

S smTises  we  ^ve  had 

tetoiy-toeMian  nuclear  test,  the  North 
Korean  missile  test,  the  terrorist  bomb- 
,Ame™an  targets  in  the  Mideast 
and  Africa.  Part  of  the  problem  is  that  we 

Srf  mm  °f  ae  sources  51131 «« 
used  to,  and  everyone  is  getting  better  at 

concealing  their  communications.  i 

So  why  is  It  so  easy  to  stir  up  these 
controversies  about  privacy?  The  simple 
f&ctis  that  relations  between  the  govern- 
ment and  the  new  Information  Industries 
I are  lousy.  There  Is  too  much  suspicion  and 
1 too  tittle  communication. ' > , 

The  administration  gets  part  of  foe 
blame  for  its  barn-handed  policies,  Canii' 
vore  as  a good  example.  A lot  of  contra 
ye^sy  could  have  been  defused  If  the  tel 
had  offered  more  insight  Into  how  the  sys- 
tem worked  and  bow  foe  rights  of  non-sus- 
pects would  be  protected. 

But  the  record  of  foe  teclmogeeks  lm 
not  been  much  better.  They  often  act,  as 
though  law  enforcement  officials  have 'no 
business  poking  Into  foeir  activities  ,kt 
all— as  though  me  could  stop  mtexnahcKai 
computer  criminals  with  a good  neighbor- 
hood watch  program. 

IV$  all  too  easy  to  lose  sight  of  the ‘fact 
that  Camivore's-foafo  targets  are  ey^rr 
eriminals~m  other  Swords,  the- 
crooks  who  are  a plague. on  the  Internet 
and  target  dot-com  companies.  Growth 
rates  for  Internet  shopping  have  been  pip- 
ping lately.  According  to  some  experts* 
people  worry  about  whether  their  credit 
card  numbers  and  health  records  are  safe. 
You  would  think  foat  e-business  would  $e 
. foe  first  to  support  better  -law  enforcement 
on  foe  netiv  , / -X  '>* ; ; •*  u ■ 
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reasonable  cooperation  from  the  private 
sector,  and  aggressive  few  enforcement  i 
and  effective  intelligence  closely  moni- 
tored by  responsible  public  officials,  ' 
Fixing  the  relationship  between  Wash- 
ington and  Silicon  Valley  needs  to  be  a top 
priority  for  the  next  administration.  The 
only  people  be&efittfrsg  from  controversies 
like  the  one  over  Carnivore  are  terrorists, 
criminals  and  rogue  states. 


Mr.  Berkowitz  is  a research  fellow  at'ihe 
Hoover  Institution  m3  coauthor  of  "Best 
Truth:  Intelligence  in  the  Information  Age" 
OWe  University  Press,  BOOOh  / 
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Honorable  Charles  T.  Canady 
Chairman 

Subcommittee  m the  Constitution 
Committee  on  the  Judiciary 
House  of  Representatives 
Washington,  D,C«  20S15 
/ 

Dear  Mr,  Chairman: 

We  very  much  appreciate  the  opportunity  to  appear  before  the  Constitution 
Subcommittee  on  Monday  to  discuss  "Carnivore.”  The  public  testimony,  we  believe,  will  be 
very  helpful  in  our  efforts  to  explain  what  Carnivore  is  and,  equally  important,  what  it  is  not. 

In  that  regard,  USA  Today  asked  us  to  provide  a brief  350  w'ord  explanation  for  use 
on  the  editorial  page.  While  a full  statement  obviously  will  be  provided  to  the  Subcommittee,  we 
would  like  to  share  with  you  the  text  of  what  was  provided  to  the  newspaper.  In  a very'  concise  fashion, 
it  encapsulates  our  explanation  of  what  the  system  does  electronically  to  ensure  strict  compliance  with 
the  court  orders  that  instruct  us  precisely  what  can  and  cannot  be  intercepted.  I also  have  enclosed  a 
graphic  that  you  may  find  helpful  . 

As  the  brief  summary  points  out,  Carnivore  is  used  only  when  Internet  Service  Providers 
are  unable  on  their  own  to  restrict  interceptions  wi  thin  the  narrow  confines  of  the  controlling  court  order. 
In  addition,  no  interception  can  occur  unless  the  FBI  or  other  law'  enforcement  agency  can  demonstrate  to 
a judge's  satisfaction  that  the  strict  statutory  requirements  have  been  met’  e.g.,  that  there  is  probable 
cause  that  a crime  is  being  or  has  been  committed,  that  the  intercepted  e-mails  will  be  in  furtherance  or 
about  that  crime,  and  that  the  interceptions  are  necessary  to  collect  evidence  of  that  crime.  That  is  why 
its  use  has  been  very  limited,  predominately  to  intercept  e-mails  in  terrorism  cases. 

I hope  you  find  this  helpful.  Again,  we  look  forward  to  testifying  and,  in  the  interim,  if 
you  have  any  questions,  please  do  not  hesitate  to  ask.  We  would  be  pleased  to  brief  on  any  aspect  of  this 
system. 


Sincerely  yours. 


John  E.  Collingwood 
Assistant  Director 
Office  of  Public  and 
Congressional  Affairs 


1 - Mr.  Pickard  - Rm  7142 
1 * Mr.  Alba  - Rm  7128 
1 - Mr.  Gallagher  - Rm  7110 
1 - Mr.  Garcia  - Rm  7116 
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X:  Dr.  Kerr  - Rm  3090 
T'yMr,  Parkinson  - Rm  7427 
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Honorable  Charles  T*  Canady 


Honorable  Henry  J.  Hyde 
House  of  Representatives 
Washington*  D,C,  20515 

Honorable  Asa  Hutchinson 
House  of  Representatives 
Washington,  RC  205  5 5 

Honorable  Spencer  Bachus 
House  of  Representatives 
Washington,  RC  20515 

Honorable  Robert  W.  Goodlatte 
House  of  Representatives 
Washington,  D,C  20515 

Honorable  Bob  Barr 
House  of  Representatives 
Washington,  D C-  20515 

Honorable  William  L.  Jenkins 
House  of  Representatives 
Washington,  RC  20515 

Honorable  Lindsey  Graham 
House  of  Representatives 
Washington,  RC  20515 

Honorable  Melvin  L.  Watt 
House  of  Representatives 
Washington,  DC  20515 


Honorable  Maxine  Waters 
House  of  Representatives 
Washington,  DC,  20515 
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Honorable  Charles  T,  Canady 

Honorable  Barney  Frank 
House  of  Representati  ves 
Washington,  D,C  20515 

Honorable  John  Conyers,  Jr, 
House  of  Representatives 
Washington,  B.C  20515 


Honorable  Jerrold  Nadler 
House  of  Representatives 
Washington,  D.C.  20515 


3 


"Vm.-kv-  - '/v>  w.v!  .>  :.it  — s. >~-v»  jj 


U.S.  Department  o.Z^stiee 

Federal  Bureau  of  investigation 


■•/If®: 

-vv'j  *.£&!&*• 


Wa sftm&mt,  iXC 


First,  lets  get  the  facts  straight.  The. FBI  and  all 

f 

t 

other  law  enforcement  agencies  ' can  only  intercept  e-mails 
pursuant  to  a court  order  signed  by  a judge  who  is  satisfied  that 
the  government  has  demonstrated  probable  cause  that  a serious 
crime  is  being  or  has  been  committed,  the  e-mails  will  be  about 
that  crime  and  the  interception  is  necessary  to  obtain  evidence 
about  the  crime.  To  conduct  an  intercept  beyond  that  is  a 
federal  crime  subject  to  severe  criminal  and  civil  sanctions. 

The  entire  process  x'equires  continual  reporting  to  a court  and, 
of  course,  ultimately  is  subject  to  vigorous  challenge  by  defense 
attorneys . 


What  does  "carnivore”  do?  In  the  simplest  terms,  it 
ensures  that  only  the  exact  communications  authorised  by  the 
court  to  be  intercepted  are  what  is  intercepted.  So,  for 
example,  if  a court  authorizes  only  the  interception  of  e-mail 
from  a particular  drug  dealer  to  another  drug  dealer,  this  system 
captures  only  that  e-mail  to  the  exclusion  of  all  other  computer 
communications  regardless  of  who  sends  them  and  where  they  are 
going.  Nothing  else  is  monitored  or  collected,  and  everything 
collected  is  supervised  by  the  court.  It  would  be  a federal 
crime  to  do  otherwise. 
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When  is  carnivore  used?  It  is  used  only  when  an 
Internet,  service  provider  cannot,  on  its  own,  effect  the 
interceptions  consistent  with  a narrow  court  order.  Accordingly, 
it  has  been  used  very  tew  times,  predominately  to  intercept 
e-mails  in  terrorism  cases  and,  again,  subject  to  the  supervision 
of  a court. 


In  1968,  Congress  spelled  out  strict  requirements  for 
the  interception  of  communications . Carnivore  simply  ensures 
that  law  enforcement  complies  precisely  with  those  requirements 
as  technology  advances.  We  understand  why  certain  segments 
oppose  this  court  ordered  technique.  But  since  1968,  because  of 
this  law,  many  lives  have  been  saved  and  thousands  of  drug 
dealers,  terrorists,  child  predators  and  spies  are  in  jail. 

The  Chairman  of  PSINet  laid  out  the  appropriate 
challenge.  He  does  not  want  to  see  carnivore  on  his  network 
unless  we  can  prove  it  sifts  out  only  the  traffic  from  the  target 
of  a coux't  order.  That,  of  course,  is  precisely  what  carnivore 
does,  electronically  protecting  the  privacy  of  those  not  subject 
to  the  court  order. 
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Carnivore  E-Mail  Tool  Won’t  Eat  Un  Privnr 
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WASHINGTON -Packed  m a slim  \&p-  STSi^^SSriiS?'  CaV*  ”m  U(lY^  tiff  T 

>P  computer,  the  Federal  Bureau  of  loves-  JL* ,fmm  Iimo'  X £jf 

rattan's  Internet  survAmanr*  mnt  users?  How  frequently  is  it  used,  and  ^ ^ 


By  Tk»  8 sums 
And  Neil  Kmc;  Jr.  v 

Staff  Reporters  uf  Tjic  Wall  Smisttr  Jtswtwii. 

WASHINGTON-Padced  m a slim  lap- 
top computer,  the  Federal  Bureau  of  inves- 
tigation’s Internet  surveillance  system. 
Carnivore,  looks  downright  docile.  One  of 
its  creators  calls  it  merely  a "tool  in  a tool 
box"  for  tracking  hackers  and  terrorists. 
Us  name,  the  FBI  admits,  is  unfortunate. 
It  is  too  late  to  change  the  name-but 
not  too  late,  the  FBI  figures,  to  try  to 
change  the -opinions  of  privacy  advocates 
*and  lawmakers  who  have  spoken  harshly 
of  the  high-tech  sniffer.  So  the  agency  has 
launched  an  Intense,  behind-the-scenes 
campaign  to  deflect  congressional  skepti- 
cism and  convince  wary  Internet  eompt- 
lies  that  Carnivore  is  a much  pickier  eater 
than  its  critics  claim. 

; Since  news  of  Carnivore  broke  last 
week,  FBI  officials  have  swarmed  Capitol 
Mil  to  demonstrate  the  system  to  key 
^embers  of  Congress  and  their  staff.  The 
officials  also  have  shown  it  to  mo  federal 
♦Mdges  and  a small  group  of  reporters  for 
fee  Waif  Street  Journal.  And  Tuesday,  the 
published  a lengthy  article  about  Qar- 
ipyorc  m its ’Web  site,  describing  ft;as  a 
^diagnostic  too!”  that  employs  new  tech- 
*h>  lawfully  obtain  important  infar- 
fniahon  while  providing  enhanced  privacy 
‘ junction/ 

The  message:  Carnivore  is  a surgical 
^pw^nforcement  device  used  rarely  and 
My  uR&or  strict  court  orders.  And,  con- 
imxy  to  fears  espoused  publicly  in  recent 
Jays,  the  system  doesn't  gobble  up  ail 
passing  e-mail  in  its  search  for  the  corre- 
-^wttdence  of  a single  suspect.  "This  de- 
' *fee  is  blind  to  everything  but  the  packet 
Jpf  information]  that  it's  set  to  retrieve/ 
Jays  Thomas  Motta,  an  assistant  general 
Joussei  for  the  mi  *IV$  like  a cop  who 
see  anything  hut  a blue  car  on  a 
'highway/ 

**••*  ^ advance  of  a hastily  called  congres- 
jlonai  hearing  next  week,  FBI  officials 
mo  have  been  expressing  regrets  about 
*the  system's  name.  Carnivore  was  the  in- 
Jouse  moniker  given  to  the  successor  of  an 
feriier  surveillance  system,  which  was 
IgHed  Omnivore.  Ho  one  thought  the  name 
;jdufd  become  public.  When  it  did  last 
4 week*  Attorney  General  Janet  Reno  called 
M 4 'mm*  change,  and  FBI  Director 
J Wis  Freeh  started  asking  how  the  bu* 
Jfeu  could  have  had  such  a tin  ear* 

/ * ’’Let's  just  say,  weYe  going  .to  put 
inames  through  the  giggle-test  a Mttle  difs 
‘Terentiy  in  the  future/  says  Donald  Km* 
director  of  the  special  Quantico,.  Va,,  lab 
that  devdooed  cimivore/  ' t:'rr 


rn<ing  more  than  merely  cosmetic  charts 
Lawmakers  are  eager  to  know  how  vora- 
cious Carnivore  could  get.  Cart  it  vacuum 
up  internet  communications  from  inno- 
cent users?  How  frequently  is  it  used,  and 
under  what  legal  basis?  Is  Carnivore 
hooked  permanency  into  the  country's  In- 

The  Workings  of  Carnivore 

* 

Ail  data  nows  through  the  internet,  \ 

##41 


m m nr w w T MM  WTATiKkW  M,  Wf 

7i  — 


' internet  Service  Provider  traffic 
the  FBI  is  tapping  flows  through 
the  Carnivore  filter. 


' All  other  data,  plus  the 
Q otigml  data  matching  the 
fitter,  flows  onward.  ■*. 


m 


\Ja±M  ± • i a * # •xhhI 

Carnivore  ISP  Client 

Filter  ' ' • -l  •• 


O .•// 

Copy  of  the  v/ 
requested  dais 
goes  to  Carnivore's 
hard  drive.  v 


' -*■  , * /«/ 

Carnivore's 
Hard  Drive 


1 


, •fee  FBI  f qtrteyos 
^md  .analyzes 
captured  data. 


ternet  service  providers?  How  can  we 
trust  that  it  does  only  what  the  FBI  says? 

Protecting  Citizens 

"We  want  to  hear  exactly  haw  this  sys- 
tem works  and  make  sure  it  raises  no  con- 
stitutional problems/  say's  Rep,  Charles 
Canady,  the  Florida  Republican  who 
heads  the  House  judiciary  subcommittee 
that  will  question  FBI  officials  next  week. 
Adds  Rep.  Asa  Hutchinson,  an  Arkansas 
Republican  and  member  of  the  same 
panel:  “We  have  to  protect  citizens  from 
inadvertent  action  as  well  as  snooping  bv 
the  government/ 

The  system  is  designed  to  allow  the 
FBI  to  conduct  efficient  wiretaps  of  e-mail 
conversations  and  other  online  communi- 
cations involving  suspected  hackers,  ter- 
rorists and  ether  criminals.  The  fear 
among  critics  is  that  Carnivore  will  scoop 
up  transmissions  made  between  innocent 
civilians  And  lay  them  open  to  scrutiny, 

Internet  providers,  such  as  Rnaaifet 
of  New  Haven,'  Conn.,  say  Carnivore  Is 
unnecessary  because  they  already  can  do 


the  monitoring  the  Ml  needs  if  ordered  by 
a court,  "We're  able  to  .do  It  faster,  more 
efficiently  and*  most  importantly*  without 
intruding  on  the  privacy  of  people  not 
within  the  scope  of  the  search/  says  Peter 
William  Sachs,  president  of  femn.Net* 
who  is  scheduled  to  testify  at  next  week's 
‘hearing*  one  of  fee  na- 

f'  hon^  largest  Memet:-service  providers, 

; says  ftTefased  earlier  this  year  to  install 
: Carnivore  on  Sts  network,  claiming  techni- 
vcai  adjustments  required the  devled 


In  its  meetings  with  lawmakers  and  otir 
ers(  the  FBI  has  described  the  inner  work- 
ings of  the  system  in  unusual  detail.  In 
one  demonstration  this  week*  the  agency 
was  keen  to  show  how  the  system  could 
tailor  its  search  so  it  captures  only  the 
e-mails  moving  into  and  out  of  one  particu- 
lar account  The  FBI  said  Carnivore  is 
smart  enough  to  capture  : a suspect's 
e-mails  while  tearing  untouched  messages 
sent  by  his  or  her  spouse  or  children. 
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4Pac|ct  Fitters* 

•The  system  belongs  to  a class  of  tools 
Known  ns  "packet  niters4'  or  *sn  lifers*" 
which  look  for  parcels  of  data  that  travel 
across  a network  and  comprise  an  e-mail 
or  a visit  to  a Web  site.  Using:  a Windows 
screen*  Carnivore  also  can  be  set  to  cap- 
ture file  downloads  and  chat-room  conver- 
sations. It  c tm  grab  e-mail  from  the  most 
popular  Web-based  companies*  including 
Yahoo!  Inc.  and  Microsoft  Corp.'s  Hot- 
mail. And  once  it  is  installed  at  an  Infer- 
net  service  provider*  the  FBI  can  dial  into 
Carnivore  to  make  changes  and  monitor 
data  that  have  been  collected. 

The  FBI  is  adamant  about  dispelling 
fears  that  Carni  vore  could  be  used  for  ram- 
pant tapping  of  public  e-mail  systems.  For 
one*  wiretapping  requests  are  closely  scru- 
tinised by  the  ^Justice  Department,  and 
must  be  approved  by  a federal  judge. 
Abuse  by  a rogue  Investigator  is  even  less 
likely,  the  bureau  says,  because  the  rogue 
would  need  too  much  cooperation  from 
other  FBI  techies  and  the  Internet  service 
provider,  says  Marcus  Thomas,  a devel- 
oper of  the  system  at  Quantleo. 


■ tw  w*'*  j iJSfclftj.-j't  s>«2 . : 


U camS*inf un  * Jt,dBe‘s  tostractlons, 
■ ramwre  am  be  set  to  merely  trace  feter- 

&STk!am  t0  and  from  a **• 

raw  nfit  pen  re{rts!er‘' or  “trap  and 
*!*  recwds  tb*  totemet  ad- 
of  passing  traffic  but  not,  for  ex- 

uS’/he  comen!s  or  even  ihe  subject 

nntton  »ith>aiLwSlRCe  lhe  amoun!  of  infor- 
mation tethered  is  relatively  small  in 

these  instances,  even  a week's  worth  of 

S!< S f " stored  on  a single 

* k‘  ^ *mcy  sa-vs-  With  judicial 
permission,  the  system  also  can  conduct 
fuller  intercepts,  which  would  gather  the 
contents  of  the  e-mails  and  other  data. 

, „ !?llf  ® says  Carnivore  doesn’t  mom- 

bi!itvlwfenf  Cf  passing  e'raaiis.  a capa- 
*****?  nsmored  to  exist  in  tiie  contro- 
ls1 KSU7eiiiance  nef wk  °P- 

crated  overseas  by  the  National  Security 

&”£“?*•*  °f!iCia,s  sald  ^teiun/for 
key  words  in  passing  e-mails  was  {Am. 

caily  possible,  but  that  ii  would  slow  inter- 
net  traffic  unacceptably  for  all  customers 

acfiS»atte  aPt  Ulth  s ®ac!i®e  like  this  to 
actually  read  everything  that  goes  by,  you 

mas  g*  C3rm°t  deai  a " Mr>  Tho- 

vo-S  -S-? ra  sa£  H has  8s«d  Caret- 

tffwun5^JSK!  25  mves^a«o«s  war 

' raos!  feting  sus- 
pected terrorists  or  computer  hackers.  In 
each  ease,  the  system  was  connected  to  t 

wft_eri.  it  intercepted  data  or  e-mails  In 
%l!h  a mm  order>  th& 

nriw  *£***«*«  w}»o  haven't  been 
pnvy  to  toe  .FBI  demonstrafitas,  huneer 

tortcanf^fi  hi^'  e^ia83ti0»s-  The  ' 
Amenc&n  Cml  taberties  Union  wants  the 

FBI  to  suspend  Carnivore's  use,  arguing 

that  Internet  providers  can  alreadvcom 

£“K?  £?"* 1»ai » £ 

ft|ed  * request  Under  the 

Sm  S 6R  Act  for  &«  hiue- 

Camfvore  works.  Many  in 

SL  ^IS  «waM  toese  same 
plans-caited  the  source  code"-to  insure 

won-far  Sy1e?  isn'f  °Pei!  to  abuse  and 
won  t disrupt  business. 

workte m3kSfg  Carnivore>s  inner 
ai]°w  tockera  to 

oeieaut.  Once  you  know  how  it  works 
triviai  to  «vade  it,”  Mr 


mnm& ays,  4 

legislation  to  ^ash  Carnivore  enti; 

tthfio  bUt  f,awTOakers  could  mow 
tighten  toe  requirements  for  its  use  o 
impose  rules  that  would  farther  pro! 
the  privacy  of  innocent  -Internet  us< 
Sar£Ie  **“*  ^vnivore  points  no 
need  for  Congress  to  wrestle  with  a if 

iawsmi‘M:  m^ne  ^ nation’s 
feted. 
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From: 

To: 

Date: 

Subject: 


7/20/00  4:38PM 
OOJ  review  of  statement. 


6&-t 

DONALD  KERR,  LARRY  PARKINSON, 


Gentlemen: 


itnf  L lrfl! i^,.K?n's  statement  to  OPCA,  I was  informed  that  DOd  will  also  review 


our  final  version  of  the  statement  before  OPCA  disseminates  mX S 

KwZSd"SSZ  ScT*  ,he  a“emM’  "'ere,om  ™ ”*»  «» 

comments  tXe  XaS”  SiKrek  “ “ °°J  reKOT"»“‘’«  <«  V™  ™view  and 


' £e£a?5S| wSTtlSd’IcPA0' ^ 251  * 4588 ”* ,hS p“'"sh™« ** 


ii 
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From: 

To: 

Date: 

Subject: 


wmira 


:20PM 
Don  Kerfs  Testimony 


hC-t 

lie.-} 


SferenSSetr!  t SSfJ?1  ifclude  a fjx  for »»  Problem  that  we  just  discussed,  namely  the 
betweenJ;til  s standards  for  interception  of  orai/wire  communications  and  those  for  etertmnt 
communications.  The  former  are  set  forth  in  18  USC  2518(1),  the  tetter  in  18  USC  2518(3). 

For  the  purpose  of  this  testimony,  the  two  main  differences  are: 

(1 ) that  applications  under  2516(3)  do  not  require*  senior  level  DOJ  approval  and  f2>  that  thev  nnt 
limited  to  certain  federal  felonies.  Thus  if  we  strike  the  sentence  at  the  bottom  of  cane  Sworton  nf  nan 

If1 rnan5?h!fl ^ rta.ulho.r*fation  b?  a se«ior  official  of  DOJ)  and  the  last  sentence  in  the  Lstpai-aoS 
page  three  ^Further,  interception  of  communications  is  limited  to  certain  specified  fetonv  offenses^ 

aroLTsr«^bj  m¥£Min9  mm?*s  8$  » wBioh  *■*  > 

use  2816(1)  raE  2™ oSs/J nrr*!  mSf  Tf instances  where  th®  testimony  suggests  that  we 
016(1}  rather  than  2518(3),  OGC  should  scrub  the  testimony  again  to  check  for  such  instances. 


CHARLES  STEELE 


4,6-f 

2 ?c  -/ 
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STATEMENT  OF 


KEVIN  V,  Di  GREGORY 
DEPUTY  ASSISTANT  ATTORNEY  GENERAL 
UNITED  STATES  DEPARTMENT  OF  JUSTICE 
BEFORE  THE  SUBCOMMITTEE  ON  THE  CONSTITUTION 
OF  THE  HOUSE  COMMITTEE  ON  THE  JUDICIARY 
' on 

“CARNWORE’*  AND  THE  FOURTH  AMENDMENT 

July  24, 2000 

Mr.  Chairman  and  Members  of  the  Subcommittee,  thank  you  for  allowing  me  this 
opportunity  to  testify  abouuhe  law  enforcement  tool  "Carnivore"  and  the  Fourth  Amendment. 
On  April  6, 2000, 1 had  the  privilege  of  testifying  before  you  during  a hearing  on  Internet  privacy 
and  the  Fourth  Amendment;  1 am  pleased  to  continue  to  participate  in  the  discussion  today  about 
Carnivore”  and  its  role  In  protecting  individual  privacy  on  the  Internet  from  unwarranted 
governmental  intrusion,  and  about  the  critical  role  die  Department  plays  to  ensure  that  the 
Internet  is  a safe  and  secure  place.  * 

Briyacy  and  Public  Safety 

It  is  beyond  dispute  that  the  Fourth  Amendment  protects  the  rights  of  Americans  while 
they  work  and  play  on  the  Internet  just  as  it  does  in  the  physical  world.  The  goal  is  a long- 
honored  and  noble  one:  to  preserve  our  pri  vacy  while  protecting  the  safety  of  our  ci  tizens.  Our 
founding  fathers  recognized  that  in  order  for  our  democratic  society  to  remain  safe  and  our 
liberty'  intact,  law  enforcement  must  have  the  ability  to  investigate,  apprehend  and  prosecute 
people  for  criminal  conduct.  At  the  same  time,  however,  our  founding  fathers  held  in  disdain  the 
government’s  disregard  and  abuse  of  privacy  in  England.  The  founders  of  this  nation  adopted  the 
Fourth  Amendment  to  address  the  tension  that  can  at  rimes  arise  between  privacy  and  public 
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safety.  Under  the  Fourth  Amendment,  the  government  must  demonstrate  probable  cause  before 
obtaining  a warrant  for  a search,  arrest,  or  other  significant  intrusion  on  privacy. 

Congress  and  the  courts  have  also  recognized  that  lesser  intrusions  on  privacy  should  be 
permitted  under  a less  exacting  threshold.  The  Electronic  Communications  Privacy  Act 
( ECPA  } establishes  a three-tier  system  by  which  the  government  can  obtain  stored  information 
Irom  electronic  communication  service  providers.  In  general,  the  government  needs  a search 
warrant  to  obtain  the  content  of  unretrieved  communications  (like  e-mail),  a court  order  to  obtain 
transactional  records,  and  a subpoena  to  obtain  information  identifying  the  subscriber.  See  58 
U.S.C.  §§  2701-11. 

In  addition,  in  order  to  obtain  source  aid  destination  information  in  real  time,  the 
government  must  obtain  a “trap  and  trace”  or  “pen  registeri’  court  order  authorizing  the  recording 
of  such  information.  See  IS  U.S.C.  1821  et.  Seq. 

Because  of  the  privacy  values  it  protects,  the  wiretap  statute,  1 S'U-S.C.  §§251 0-22, 
commonly  known  as  Title  113,  places  a higher  burden  on  the  real-time  interception  of  oral,  wire 
and  electronic  communications  than  the  Fourth  Amendment  requires,  hr  the  absence  of  a 
statutory  exception,  the  government  needs  a court  order  to  wiretap  communications.  To  obtain 
such  an  order,  the  government  must  show  that  normal  investigative  techniques  for  obtaining  the 
information  have  or  are  likely  to  fail  or  are  too  dangerous,  and  that  any  interception  will  be 
conducted  so  as  to  ensure  that  the  intrusion  is  minimized. 

The  safeguards  for  privacy  represented  by  the  Fourth  Amendment  and  statutory 
restrictions  on  government  access  to  information  do  cot  prevent  effective  law  enforcement 
Instead,  they  provide  boundaries  for  law  enforcement  clarifying  what  is  acceptable  evidence 
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gathering  and  what  is  not.  At  the  same  time,  those  who  care  deeply  about  protecting  individual 
privacy  must  also  acknowledge  that  law  enforcement  has  a critical  role  to  play  in  preserving 
privacy.  When  law  enforcement  investigates,  successfully  apprehends  and  prosecutes  a criminal 
who  has  stolen  a citizen’s  personal  information  from  a computer  system,  for  example  "law 
enforcement  is  undeniably  working  to  protect  privacy  and  deter  further  privacy  violations.  The 

''  same  is  trae  when  lsw  enforcement  apprehends  a hacker  who  compromised  the  financial  records 
of  a bank  customer. 

As  we  move  into  the  2 1S!  century,  we  must  ensure  that  foe  needs  of  privacy  and  public 
safety  remain  in  balance  and  are  appropriately  reflected  in  the  new  and  emerging  technologies 
that  are  changing  the  face  of  communications.  Although  the  primary  mission  of  the  Department 
of  Justice  is  law'  enforcement.  Attorney  General  Reno  and  foe  entire  Department  understand  and 
share  the  legitimate  concerns  of  all  Americans  with  regard  to  personal  pri  vacy.  The  Department 
has  been  and  will  remain  committed  to  protecting  the  privacy  rights  of  individuals.  We  look- 

forward  to  working  with  Congress  and  other  concerned  individuals  to  address  these  important 
matters  in  foe  months  ahead. 


Law  En 


Although  foe  Fourth  Amendment  is  over  two  centuries  old,  foe  Internet  as  we  know  it  is 

!>  • •.  v . * =■  . . 

still  m its  infancy.  The  huge  advances  in  the  past  ten  years  have  changed  forever  the  landscape 
of  society,  not  just  in  America,  but  worldwide.  He  Internet  has  resulted  in  new  and  exciting 
ways  for  people  to  communicate,  transfer  information,  engage  in  commerce,  and  expand  their 
educational  opportunities.  These  axe  hut  a few  of  foe  wonderful  benefits  of  this  rapidly  changing  - - 

technology.  As  has  been  the  case  with  every  major  technological  advance  in  our  history. 
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however,  we  are  seeing  individuals  and  groups  use  this  technology  to  commit  criminal  acts.  As 
Deputy  Attorney  General  Eric  Holder  told  the  Crime  Subcommittee  of  this  Committee  in 
February,  our  vulnerability  to  computer  crime  is  astonishingly  high  and  threatens  not  only  our 
financial  well-being  and  our  privacy,  but  also  this  nation’s  critical  infrastructure. 

t 

Many  of  the  crimes  that  we  confront  everyday  in  the  physical  world  are  beginning  to 
appear  in  the  online  world.  Crimes  like  threats,  extortion,  fraud,  identity  theft,  and  child 
pornography  are  migrating  to  the  Internet  The  Fourth  Amendment  and  laws  addressing  privacy 
2nd  public  safety  serve  as  a framework  for  law  enforcement  to  respond  to  this  new  forum  for 


criminal  activity.  If  law  enforcement  fails  properly  to  respect  individual  privacy  in  its 
investigative  techniques,  the  public’s  confidence  in  government  will  be  eroded,  evidence  will  be 
suppressed,  and  criminals  will  dude  successful  prosecution.  If  Saw  enforcement  is  too  timid  in 


responding  to  cybercrime,  however,  we  will,  in  effect,  render  cyberspace  a safe  haven  for 
entnmais  and  terrorists  to  communicate  and  carry  out  crime,  without  fear  of  authorized 


government  surveillance.  If  we  fall  to  make  the  Internet  safe,  people’s  confidence  in  using  the 

Internet  and  e-commerce  will  decline,  endangering  the  very  benefits  brought  by  the  Information 
Age,  Proper  balance  is  the  key. 


To  satisfy  our  obligations  to  the  public  to  enforce  the  laws  and  preserve  the  safety,  we  use 
the  same  sorts  of  investigatory  techniques  and  methods  online  as  we  do  in  the  physical  world, 
with  fee  same  careful  attention  to  the  strict  constitutional,  statutory,  internal  and  court-ordered 
boundaries.  Carnivore  is  simply  an  investigatory  tool  that  is  used  online  only  under  narrowly 

defined  circumstances,  and  only  when  authorized  by  law,  to  meet  our  responsibilities  to  the 
public. 
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To  illustrate,  law  enforcement  often  needs  to  find  oat  from  whom  a drug  dealer,  for 
instance,  is  buying  his  illegal  products,  or  to  whom  the  drug  dealer  is  selling.  To  investigate  this 
it  is  helpful  to  determine  who  is  communicating  with  the  drug  dealer.  In  the  ‘'olden  days”  of 
perhaps  10  years  ago,  the  drag  dealer  would  have  communicated  with  his  supplier  and  customers 
exclusively  through  use  of  telephones  and  pagers.  Law  enforcement  would  obtain  an  order  from 
a court  authorizing  the  installation  of  a “trap  and  trace”  and  a "pen  register”  device  on  the  drug 
dealer's  phone  or  pager,  and  either  the  telephone  company  or  law  enforcement  would  have 
installed  these  devices  to  comply  with  the  court’s  order.  Thereafter,  the  source  and  destination  of 
his  phone  calls  would  have  been  recorded.  This  is  information  that  courts  have  held  is  not 
protected  by  any  reasonable  expectation  of  privacy.  Given  the  personal  nature  of  this 


information,  however,  the  law  requires  government  to  obtain  an  order  under  these  circumstances. 


ht  this  way,  privacy  is  protected  and  law  enforcement  is  able  to  investigate  to  protect  the  public 
Now,  that  same  drag  dealer  may  be  just  as  likely  to  send  an  e-mail' as  call  his 


confederates.  When  law  enforcement  uses  a "trap  and  trace”  or  “pen  register”  in  the  online 
context,  however,  we  have  found  that,  at  times,  the  Internet  sendee  provider  has  been  unable  or 


even  unwilling  to  supply  tins  information.  Law  enforcement  cannot  abdicate  its  responsibility  to 
protect  public  safety  simply  because  technology  has  changed.  Rather,  the  public  rightfully 
expects  dial  law'  enforcement  will  continue  to  be  effective  as  criminal  activity  migrates  to  the 
Internet.  We  cannot  do  this  without  tools  like  Carnivore, 

When  a criminal  uses  e-mail  to  send  a kidnaping  demand,  to  buy  and  sell  illegal  drags  or 
to  distribute  child  pornography,  law  enforcement  needs  to  know  to  whom  he  is  sending  messages 


and  from  whom  he  receives  them.  To  get  this  information, 


we  obtain  a court  order,  which  wc 
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sen'e  on  fee  appropriate  service  provider.  Because  of  fee  nature  of  internet 


communications,  the 


addressing  information  (which  does  not  include  fee  content  of  the  message)  is  often  mixed  in 
wife  a Jot  of  other  non-content  data  that  we  have  no  desire  or  authority  to  gather.  If  fee  sendee 
provider  can  comply  with  the  order  and  provide  us  wife  only  fee  addressing  information  required 
by  court  order,  it  will  do  so  and  we  will  not  employ  Carnivore.  If,  however,  fee  service  provider 
is  unwilling  or  unable  to  comply  with  the  order,  we  simply  cannot  give  a criminal  a free  pass.  It 
is  for  that  narrow  set  of  circumstances  that  fee  FBI  designed  “Carnivore.” 

Carnivore  is,  in  essence,  a special  filtering  too!  feat  can  gather  the  information  authorized 
by  court  order,  and  only  that  information.  It  permits  law  enforcement,  for  example,  to  gather 
only  the  enuil  addresses  of  those  persons  with  whom  the  drug  dealer  is  communicating,  without 
allowing  any  human  being,  either  from  law  enforcement  or  the  service  provider,  to  view  private 
information  outside  of  the  scope  of  the  court’s  order.  In  other  words.  Carnivore  is  a minimization 
tool  that  permits  law  enforcement  strictly  to  comply  with  court  orders,  strongly  to  protect 
privacy,  and  effectively  to  enforce  fee  law  to  protect  the  public  interest  hi  addition.  Carnivore 
creates  an  audit  trail  that  demonstrates  exactly  what  it  is  capturing. 

As  with  any  other  investigative  tools,  there  are  many  mechanisms  we  have  in  place  to 
prevent  against  possible  misuse  of  Carnivore,  and  to  remedy  misuse  feat  has  occurred.  The 
Fourth  Amendment,  of  course,  restricts  what  law  enforcement  can  do  with  Carnivore,  as  do  the 

statutory  requirements  of  Title  III  and  the  Electronic  Communications  Privacy  Act,  and  the 
courts. 

For  federal  Title  HI  applications,  the  Department  of  Justice  imposes  its  own  guidelines  on 
top  of  fee  privacy  protections  provided  by  the  Constitution,  statutes  and  fee  courts.  For  example. 


5/24/02  Release  - PageC6 


before  Carnivore  may  be  used  to  intercept  wire  or  electronic  communications,  the  requesting 
investigatory  agency  must  obtain  approval  from  the  Department  of  Justice.  Specifically,  the 
Office  of  Enforcement  Operations  in  the  Criminal  Division  of  the  Department  reviews  each 

*r 

proposed  Title  HI  application  to  ensure  that  the  interception  satisfies  the  Fourth  Amendment 
requirements,  and  is  in  compliance  with  applicable  statutes  and  regulations.  Similarly,  typically 
the  U.S.  Attorney  or  the  section  chief  within  the  Department  who  is  handling  the  investigation 
also  reviews  the  Title  III  intercept  request.  Even  if  the  proposal  clears  the  OEO,  approval  must 
be  given  by  a Deputy  Assistant  Attorney  General  Although  this  requirement  of  high-level 
review  is  required  by  Title  HI  only  with  regard  to  proposed  intercepts  of  wire  and  oral 
communications,  the  Department  voluntarily  imposes  the  same  level  of  review  for  proposed 
interceptions  of  electronic  communications  (except  digital-display  pagers).  Typically, 
investigative  agencies  such  as  the  Federal  Bureau  of  Investigation  have  similar  internal 
requirements,  separate  and  apart  from  Constitutional,  statutory'  or  Department  of  Justice 
requirements. 

If  the  investigative  agency  and  the  Department  of  Justice  approve  a federal  Title  HI 
request,  it  still  must,  of  course,  be  approved  by  the  proper  court.  The  court  will  evaluat  e the 
application  under  the  Fourth  Amendment  and  using  the  familiar  standards  of  Title  HI.  By  statute, 
for  example,  the  application  to  the  court  must  show,  through  sworn  affidavit,  why  the  intercept  is 
necessary  as  opposed  to  other  less-intrusive  investigatory  techniques.  The  application  must  also 
provide  additional  detail,  including  whether  there  have  been  previous  interceptions  of 
communications  of  the  target,  the  identity  of  the  target  (ifkaown),  the  nature  and  location  of  the 
communications  facilities,  and  a description  of  the  type  of  communications  sought  and  the 
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ofienses  to  which  the  communications  relate.  By  statute  and  internal  Department  regulation,  the 
interception  may  last  no  longer  than  30  days  without  an  extension  fey  the  court. 

Courts  also  often  impose  their  own  requirements.  For  example,  many  federal  courts 
require  that  the  investigators  provide  periodic  reports  setting  forth  information  such  as  the 
number  of  communications  intercepted,  steps  taken  to  minimize  irrelevant  traffic,  and  whether 
the  interceptions  have  been  fruitful.  The  court  may,  of  course  terminate  the  interception  at  any 
time. 

The  remedies  for  violating  Title  331  or  ECFA  by  improperly  intercepting  electronic 
communications  can  include  criminal  sanctions,  civil  suit,  and  for  law  enforcement  agents, 

adverse  employment  action.  For  violations  of  the  Fourth  Amendment,  of  oourse7foe  remedv^  of 
suppression  is  also  available. 

Carnivore  itself  also  contains  self-regularing  features.  For  example,  because  of  its 
sophisticated  passive  filtering  features,  it  automates  the  process  of  minimization  without 
intrusive  monitoring  by  investigators,  and  simply  disregards  packets  of  information  that  do  not 
satisfy  the  criteria  in  the  court  ’s  authorization.  Indeed,  one  of  the  most  powerful  privacy- 
protecting  features  of  Carnivore  is  its  ability  to  ignore  information  that  is  outside  the  scope  of  foe 
court-ordered  authority.  For  later  verification,  it  also  logs  the  filter  settings.  In  addition,  as  a 
practical  matter,  Carnivore  is  not  deployed  except  with  close  cooperation  with  foe  appropriate 
system  provider.  In  any  event,  the  FBI  does  not  use  Carnivore  in  every  instance  in  which  foe 
court  orders  a Title  SI  electronic  communication  intercept.  Indeed,  I understand  that  foe  Bureau 
uses  Carnivore  only  In  those  instances  when  the  sendee  provider  is  unable  to  comply  with  the 
court  order  using  its  own  equipment,  or  when  the  provider  asks  foe  FBI  to  use  Bureau  equipment. 

8 
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As  I testified  in  April,  we  face  three  major  categories  of  challenges  in  tiding  to  keep  the 


Internet  a safe  and  secure  place  for  our  citizens.  These  are: 

1.  Technical  challenges  that  hamper  law  enforcement's  ability  to  locate  and 
prosecute  criminals  that  operate  online; 

2.  Certain  substantive  and  procedural  laws  that  have  not  kept  pace  with  the  changing 
technology,  creating  significant  legal  challenges  to  effective  investigation  and 
prosecution  of  crime  in  cyberspace;  and 


3.  Resource  needs  that  must  be  addressed  to  ensure  that  law  enforcement  can  keep 
pace  with  changing  technology  and  has  the  ability  to  hire  and  train  people  to  fight 
cybercrime. 

Carnivore  is  an  investigative  tool  that  assists  us  in  meeting  the  first  challenge.  As  we 
have  witnessed,  tracking  a criminal  online  is  not  always  an  impossible  task  using  our 
investigative  tools.  For  example,  last  year  federal  and  state  law  enforcement  combined  to 
successfully  apprehend  the  creator  of  the  Melissa  virus  and  the  indi  vidual  who  created  a ' 
fraudulent  Bloomberg  News  Service  website  in  order  to  artificially  drive  up  the  stock  price  of 
PairGain,  a telecommunications  company  based  in  California,  Although  we  are  proud  of  these 
important  successes,  we  still  face  significant  challenges  as  online  criminals  become  more  and 
more  sophisticated. 

In  nearly  every  online  case,  tracking  the  online  criminal  requires  law  enforcement 
to  attempt  to  trace  the  “electronic  trail”  from  the  victim  back  to  the  perpetrator.  In  effect,  this 
electronic  trail  is  fee  fingerprint  of  the  twenty-first  century  — only  much  harder  to  find  and  not 
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as  permanent  as  its  more  traditional  predecessor,  fa  die  physical  world,  a criminal  and  Ms  victim 

j 

are  generally  in  the  same  location.  But  cybercriminals  do  not  have  to  physically  visit  the  crime 
scene.  Instead  they  cloak  their  illegal  activity  by  weaving  communications  through  a series  of 
anonymous  remailers,  by  creating  forged  e-mail  headers  with  powerful  point  and  click  tools 
readily  downloadable  from  hacker  websites,  by  using  a “free-trial”  account  or  two,  or  by  “wiping 

clean  the  logging  records  that  would  be  evi  dence  of  their  activity. 

! 

fa  some  cases,  the  criminal  may  not  even  be  in  the  same  country'  as  the  victim.  The  global 


nature  of  the  Internet,  while  one  of  the  greatest  assets  of  theifatemet  to  law-abiding  citizens, 
allows  criminals  to  conduct  their  illegal  activity  from  across  the  globe,  fa  these  cases,  the  need 


to  respond  quickly  and  track  the  criminal  is  increasingly  complicated  and  often  frustrated  by  the 
fact  that  the  activity  takes  place  throughout  different  countries.  With  more  than  190  countries 


connected  to  the  Internet,  it  is  easy  to  understand  the  coordination  challenges  that  face  law 
enforcement.  Furthermore,  in  these  cases,  time  is  of  the  essence  and  die  Victim  may  not  even 


realize  they  have  been  victimized  until  die  criminal  has  long  since  signed-off.  Clearly,  the 
technical  challenges  for  law  enforcement  are  real  and  profound. 


This  fact  was  made  clear  in  the  findings  and 


j 

conclusions  reached  fa  the  recently  released 


report  of  the  President’s  Working  Group  on  Unlawful  Conduct  on  the  Internet,  entitled,  “The 
Electronic  Frontier:  The  Challenge  of  Unlawful  Conduct  favjolvmg  the  Use  of  the  Internet.”  This 
extensive  report  highlights  in  detail  the  significant  challenges  facing  law  enforcement  in 
cyberspace.  As  the  report  states,  the  needs  and  challenges  confronting  law  enforcement,  “are 
neither  trivial  nor  theoretical”  The  Report  outlines  a three-pronged  approach  for  responding  to 
unlawful  activity  on  the  Internet: 
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Conduct  on  the  Internet  should  be  treated  in  the  same  manner  as  similar  conduct 
offline,  in  a technology  neutral  manner. 

We  must  recognise  that  the  needs  and  challenges  of  law  enforcement  posed  by  the 
Internet  are  substantial,  including  our  the  need  for  resources,  up-to  date 
investigative  tools  and  enhanced  multi-jurisdictional  cooperation. 

Finally,  continued  support  for  private  sector  leadership  in  developing  tools  and 
methods  to  help  Internet  users  to  prevent  and  minimize  the  risks  of  unlawful 
conduct  online. 


I would  encourage  anyone  with  an  interest  in  this  important  topic  to  review  carefully  the 

report  of  the  Working  Group.  The  report  can  be  found  on  fee  Internet  by  visiting  the  website  of \ — 

the  Department  of  Justice’s  Computer  Crime  and  Intellectual  Property  Section,  located  at 
~~~ — - In  addition  to  the  report,  sajWtgyb^,crim e.  noy  also  contains  other  useful 
information  on  a wi  de  array  of  Internet  related  issues,  including  the  topic»of  today’s  hearing  - 
privacy. 

Despite  the  type  of  difficulties  outlined  in  fee  Unlawful  Conduct  Report  and  discussed 
today,  the  Justice  Department  and  law  enforcement  across  this  nation  are  committed  to 
continuing  to  work  together  and  with  their  counterparts  in  other  countries  to  develop  and 
implement  investigative  strategies  to  successfully  track,  apprehend,  and  prosecute  individuals 
who  conduct  criminal  activity  on  the  Internet,  h so  doing,  fee  same  privacy  standards  that  apply 
in  fee  physical  world  remain  effective  online. 

Mr.  Chairman,  fee  Department  of  Justice  has  taken  a proactive  leadership  role  in  making 
cyberspace  safer  for  all  Americans.  The  cornerstone  of  our  cybercrime  prosecutor  program  is  fee 


11 
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Crimmal  Division’s  Computer  Crime  and  Intellectual  Property  Section,  known  as  CCIPS. 

CCEPS  was  founded  in  1991  as  the  Computer  Crime  Unit,  and  became  a Section  in  1996,  CCIPS 
has  grown  from  five  attorneys  in  1996  to  twenty  today  - and  we  need  more  to  keep  pace  with  the 
demand  for  their  expertise.  The  attorneys  in  CCIPS  work  closely  on  computer  crane  cases  wife 
Assistant  United  States  Attorneys  known  as  “Computer  and  Telecommunications  Coordinators,” 
or  CTC’s,  in  U.S.  Attorney’s  Offices  around  fee  nation.  Each  CTC  receives  special  training  and 
equipment  and  serves  as  fee  district’s  expert  on  computer  crime  cases.  CCIPS  and  the  CTC’s 
work  together  In  prosecuting  cases,  spearheading  training  for  local,  state  and  federal  law 
enforcement,  working  wife  international  counterparts  to  address  difficult  international 
challenges,  and  providing  legal  and  technical  instruction  to  assist  in  the  protection  of  this 
nation’s  critical  infrastructures.  We  are  very- proud  of  fee  work  these-  people  do  and  we  will 
continue  to  work  diligently  to  help  stop  criminals  from  victimizing  people  online. 

I also  note  that  public  education  is  an  important  component  of  the  Attorney  General’s 
strategy  on  combating  computer  crime.  As  she  often  notes,  the  same  children  who  recognize  that 
it  is  wrong  to  steal  a neighbor’s  mail  or  shoplift  do  not  seem  to  understand  feat  it  is  equally 
w - ong  to  steal  a neighbor’s  e-maii  or  copy  a proprietary'  software  or  music  file  without  paying  for 
it  To  remedy  this  problem,  fee  Department  of  Justice,  together  with  the  Information  Technology 
Association  of  America  (FTAA),  has  embarked  upon  a national  campaign  to  educate  and  raise 
awareness  of  computer  responsibility  and  to  provide  resources  to  empower  concerned  citizens. 

The  “Cyberoitizen  Awareness  Program”  seeks  to  engage  children,  young  adults,  and  others  on 
fee  basics  of  critical  information  protection  and  security  and  on  the  limits  of  acceptable  online 
behavior.  The  objectives  of  fee  program  are  to  give  children  an  understanding  of  cyberspace 
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benefits  and  responsibilities,  an  awareness  of  consequences  resulting  from  the  misuse  of  the 
medium  and  an  understanding  of  the  personal  dangers  that  exist  on  the  Internet  and  techriujues  to 
avoid  being  harmed. 

Conclusion: 

/ * 

Mr,  Chairman,  I want  to  thank  you  again,  for  this  opportunity  to  test?  fy  today  about  our 

efforts  to  fight  crime  on  the  Internet  while  preserving  the  rights  conferred  by  the  Fourth 

Amendment  and  statute.  Ultimately,  the  decision  as  to  the  appropriate  parameters  of  law 

enforcement  activity  lies  squarely  within  the  Constitution  and  the  elected  representatives  of  the 

people,  the  Congress.  The  need  to  protect  the  privacy  of  the  American  people  - not  j ust  from  the 

government  but  also  from  criminals  - is  a paramount  consideration,  not  just  in  the  context  of  the 

Internet,  but  in  general.  The  Department  of  Justice  stands  ready  to  work  with  this  Subcommittee 

and  others  to  achieve  the  proper  balance  between  the  important  need  for  protecting  privacy  and 

the  need  to  respond  to  the  growing  threat  of  crime  in  cyberspace.  , 

Mr.  Chairman,  that  concludes  my  prepared  statement.  I would  be  pleased  to 

attempt  to  answer  any  questions  that  you  may  have  at  this  time. 
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Statement  for  the  Record  of 
Donald  M.  Kerr 
Assistant  Director 
Federal  Bureau  of  investigation 
Before  the 

United  States  House  of  Representatives 
The  Committee  on  the  Judiciary 
Subcommittee  on  the  Constitution 
, Washington,  D.C. 

7/24/2000 

Good  afternoon,  Mr.  Chairman,  and  Members  of  the  Subcommittee.  I am  grateful  for  this 
opportunity  to  discuss  the  FBI’s  Internet  and  data  interception  capabilities  and  to  help  set  the 
record  straight  regarding  this  important  issue.  I would  like  to  first  discuss  FBI’s  legal  authority  for 
conducting  interceptions  on  the  Internet,  and  then  describe  Carnivore  and  how  we  use  it. 

Two  weeks  ago,  the  Wall  Street  Journal  published  an  article  entitled  "FBI’s  system  to  covertly 
search  e-mail  raises  privacy,  legal  issues."  This  story  was  immediately  followed  by  a number  of 
similar  reports  in  the  press  and  other  media  depicting  Carnivore  as  something  ominous  and  raising 
concerns  about  the  possibility  of  its  potential  to  snoop,  without  a court  order,  into  the  private  E- 
mails  of  American  citizens.  I think  t hat  it  is  important  that  this  topic  be  discussed  openly-and  in 
fact  this  was  the  purpose  behind  the  FBI  choosing  to  share  information  regarding  this  capability 
with  the  industry'  experts  several  weeks  ago.  It  is  critically  important  that,  as  technology,  and 
particularly  communications  technology,  continues  to  evolve  rapidly,  the  public  be  guaranteed  that 
their  government  is  observing  the  statutory  and  constitutional  protections  which  they  demand  I 
bekeve  that  it  is  also  very  important  that  these  discussions  be  placed  into  the  context  into  which 
they  properly  belong  and  that  the  tree  facts  concerning  this  issue  are  made  clear.  More  to  the  point, 
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that  these  capabilities  are  used  only  with  lawful  authorization  and  that  they  are  directed  at  the  most 
egregious  violations  of  national  security  and  public  safety. 


Ftrst  of  all,  the  FBI  performs  interceptions  of  criminal  wire  and  electronic  communications, 
including  Internet  communications,  under  authorities  derived  in  part  from  Title  Iff  of  the  Omnibus 
Crime  Control  and  Safe  Streets  Act  of  1 968  (as  amended),  which  is  commonly  referred  to  as  "Title 
HI",  and  portions  of  the  Electronic  Communications  Privacy  Act  of  1986  (as  amended),  or 
"ECPA",  I want  to  stress  that  all  such  interceptions,  with  the  exception  of  a rarely  used 
"emergency"  authority  or  consent  of  a participant  in  the  communication,  are  performed  under  a 
court  order  issued  by  a judge.  Under  emergency  provisions,  the  Attorney  General,  the  Deputy  or 
the  Associate  Attorney  General  may,  if  authorized,  initiate  electronic  surveillance  of  wire  or 
electronic  communications  without  a court  order,  but  only  if  an  application  for  such  order  is  made 
within  48  hours  after  the  surveillance  is  initiated. 

■V 

Federal  surveillance  laws  must  comply  with  the  Fourth  Amendment's  dictates  concerning 
reasonable  searches  and  seizures,  but  they  also  include  a number  of  provisions  that  are  intended  to 
ensure  that  this  investigative  technique  is  used  judiciously  and  with  deference  to  the  privacy  of 

intercepted  subjects  and  certainly  with  deference  to  the  privacy  of  those  who  are  no,  the  subject  of 
the  court  order. 


For  example,  unlike  search  warrants  for  physically  searching  a house,  under  Title  HI  and 
Department  oflustice  policy,  applications  for  interception  of  oral,  wire  and  electronic 
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communications  require  the  authorization  of  a high-level  Department  of  Justice  (DOJ)  official 
before  the  local  United  States  Attorneys  offices  can  make  an  application  to  a federal  court 
Further,  interception  of  communications  is  limited  to  certain  federal  criminal  offenses. 

Applications  for  electronic  surveillance  must  demonstrate  probable  cause  and  state  with 
particularity  and  specificity:  the  offenses  being  committed,  the  telecommunications  facility  or 
place  from  which  the  subject’s  communications  are  to  be  intercepted,  a description  of  the  types  of 
conversations  to  be  intercepted,  and  the  identities  of  the  persons  committing  the  offenses  and 
anticipated  to  be  intercepted.  Thus,  criminal  electronic  surveillance  laws  focus  on  gathering  hard 
evidence—  not  intelligence. 

Applications  must  indicate  that  other  normal  investigative  techniques  have  been  tried  and  failed  to 
gather  evidence  of  crime,  or  will  not  work,  or  are  too  dangerous,  and  must  include  information 
concerning  any  prior  electronic  surveillance  regarding  the  subject  or  facility  in  question.  Court 
orders  are  initially  limited  to  30  days,  with  extensions  possible,  and  must  terminate  sooner  if  the 
objectives  are  obtained.  Judges  may,  and  usually  do,  require  periodic  reports  to  the  court, 
typically  every  7 to  10  days,  advising  it  of  the  progress  of  the  interception  effort.  This  assures 
close  and  on-going  oversight  of  the  electronic  surveillance  by  the  United  States  Attorney's  office 
handling  tire  case  and  frequently  the  court. 
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Interceptions  are  lequired  to  be  conducted  in  such  a way  as  to  "minimize  the  interception  of 
communications  not  otherwise  subject  to  interception"  under  the  law,  such  as  unrelated,  irrelevant 
and  non-criminal  communications  of  the  subjects  and  of  others  not  named  in  the  application 


To  ensure  privacy  protection  and  evidentiary  integrity  of  the  communications  that  are  intercepted 
such  intercept  ed  communicat  ions  are  req  uired  to  b e recorded,  if  possible,  on  tape  or  o ther  device, 
and  recorded  in  such  a way  as  will  protect  the  recording  from  editing  or  other  alterations. 
Immediately  upon  the  expiration  of  the  Interception  period,  these  recordings  are  then  required  to 
be  presented  to  the  federal  district  court  judge  and  sealed  under  his  or  her  directions.  The  presence 
of  the  sea!  shall  be  a prerequisite  for  their  use  or  disclosure,  or  for  the  introduction  of  evidence 

derived  from  the  tapes.  Applications  and  orders  signed  by  the  judge  are  also  to  be  sealed  by  the 
judge. 


W ithin  a reasonable  period  of  time  aft  er  the  termination  of  the  intercept  order,  including 
extensions,  the  judge  shall  ensure  that  the  subject  of  the  interception  order,  and  other  parties  as  are 
deemed  appropriate,  are  furnished  an  inventory,  providing  notice  of  the  order,  the  dates  during 
which  the  interceptions  were  carried  out,  and  whether  or  not  the  person  was  intercepted.  Upon 

motion,  the  judge  may  also  direct  that  portions  of  the  contents  of  the  intercepted  communication 
be  made  available  to  for  their  inspection. 


Any  person  who  was  a party  to  an  intercepted  communication  or  was  a party  against  whom  an 
interception  was  directed  may  in  any  trial,  hearing,  or  other  proceeding  move  to  suppress  the  con- 
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tents  of  any  intercepted  communication  or  any  evidence  derived  therefrom  if  there  are  grounds 
demonstrating  that  the  communication  was  intercepted  in  violation  of  Title  III,  EC-PA  or  the 
Fourth  Amendment, 


The  illegal,  unauthorized  conduct  of  electronic  surveillance  is  a federal  criminal  offense 
punishable  by  imprisonment  for  up  to  five  years,  a fine,  or  both,  in  addition,  any  person  whose 
communications  are  unlawfully  intercepted,  disclosed,  or  used,  may  in  a civil  action  recover  from 
the  person  or  entity  engaged  in  the  violation  civil  damages,  including,  if  appropriate,  punitive 
damages,  as  well  as  attorney's  fees  and  other  costs  incurred. 


1 he  technical  assistance  of  the  service  providers  in  helping  a law  enforcement  agency  execute  an 
electronic  surveillance  order  is  always  important,  and  in  many  cases  it  is  absolutely  essential.  This 
circumstance  is  increasingly  the  case  with  the  advent  of  advanced  communications  services  and 
networks  such  as  the  Internet.  Title  III  mandates  service  provider  assistance  incidental  to  law 
enforcement's  execution  of  electronic  surveillance  orders  by  specifying  that  a court  order 
authorizing  the  interception  of  communications  shall  upon  the  request  of  the  applicant,  direct  that 
a “service  provider,  landlord,  custodian,  or  other  person  shall  furnish  the  applicant  forthwith  all 
information,  facilities,  and  technical  assistance  necessary  to  accomplish  the  interception 
unobtrusively  and  with  a minimum  of  interference  with  the  services  that  such  service  provider, 
landlord,  custodian,  or  person  is  according  the  person  whose  communications  are  to  be 
intercepted.” 
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In  practice,  judges  may  sign  two  orders:  one  order  authorizing  the  law  enforcement  agency  to 
conduct  the  electronic  surveillance,  and  a second,  abbreviated,  assistance  order  directed  to  the 
semce  provider,  specifying,  for  example  in  the  case  of  E-mail,  the  E-mail  account  name  of  the 
subject  that  is  the  object  of  the  order  and  directing  the  provision  of  necessary  assistance. 

t 

Semce  providers  and  their  personnel  are  subject  to  the  electronic  surveillance  laws  like  public 
officials  and  private  persons.  That  is,  unauthorized  electronic  surveillance  is  forbidden,  and 
criminal  and  civil  liability  may  be  assessed  for  violations.  Not  only  are  unauthorized  interceptions 
proscribed,  bu  t so  also  is  the  use  or  disclosure  of  the  contents  of  communications  that  have  been 
illegally  intercepted.  It  is  for  this  reason,  among  others,  that  service  providers  typically  take  great 
care  in  providing  assistance  to  law  enforcement  in  carrying  out  electronic  surveillance  pursuant  to 
court  order.  In  some  instances,  service  providers  opt  to  provide  “full"  service,  essentially  carrying 
out  the  interception  for  law  enforcement  and  providing  the  final  interception  product,  but,  in  most 
cases,  service  providers  are  inclined  only  to  provide  the  level  of  assistance  necessary  to  allow  the 
law  enforcement  agency  to  conduct  the  interception.  I want  to  stress  that  the  FBI  does  not  conduct 
interceptions,  install  and  operate  pen  registers,  or  use  trap  & trace  devices  without  Jawiiil 
authorization  from  a court  . 


In  recent  years,  it  has  become  increasingly  common  for  the  FBI  to  seek,  and  forjudges  to  issue, 
orders  for  Title  III  interceptions  which  are  much  more  detailed  than  older  orders  which  were 
directed  against  “plain  old  telephone  services."  These  detailed  orders,  in  order  to  be  successfully 
implemented,  require  complex  approaches  to  ensure  that  only  messages  for  which  there  is 
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probable  cause  to  intercept,  are,  in  fact,  intercepted.  The  fact  that  court  orders  are  becoming  more 
detailed  is  in  response,  I think,  to  two  facts. 


First,  the  complexity  of  modern  communications  networks,  like  the  Internet,  as  well  as  the 
complexity  of  modern  users’  communications  demand  better  discrimination  than  for  older  analog 
communications.  For  example,  Internet  users  frequently  use  electronic  messaging  services,  like  E- 
mail,  to  communicate  with  other  individuals  in  a manner  reminiscent  of  a telephone  call,  only  with 
text  instead  of  voice.  Such  messages  are  often  the  targets  of  court  ordered  interception.  Users  also 
use  services,  like  the  world  wide  web,  which  looks  more  like  print  media  than  a phone  call. 
Similarly,  some  Interact  services,  like  streaming  video,  have  more  in  common  with  broadcast 
media  like  television,  than  with  telephone  calls.  These  types  of  communications  are  less 
commonly  the  targets  of  an  interception  order. 

1 he  second  fact  is  that  for  many  Internet  services,  users  share  communications  channels, 
addresses,  etc.  These  facts  make  the  interception  of  messages  for  which  law  enforcement  has 
probable  cause,  to  the  exclusion  of  all  others,  very  difficult.  Court  orders  are  therefore  increasingly 
written  to  include  detailed  instructions  for  ensuring  that  the  privacy  of  communications  for  which 
there  is  no  probable  cause  to  intercept  is  guaranteed.  ......  .. 

In  response  to  a critical  need  for  tools  to  implement  these  complex  court  orders,  the  FBI  developed 
a number  of  capabilities  including  the  software  program  called  “Carnivore.”  Carnivore  is  a very 
specialized  network  analyzer  or  “snifter”  which  runs  on  a normal  Personal  Computer  running  the 
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Microsoft  Windows  operating  system.  I,  works  by  -sniffing"  the  proper  portions  of  network 
packets  and  copying  and  storing  only  rhose  packets  which  match  a finely  defined  filter  set 
programed  in  conformity  with  the  coon  order.  This  filter  set  can  be  erdtemely  complex,  and  this 
provides  tire  FBI  with  an  ability  to  collect  transmissions  which  comply  with  pen  register  court 
orders,  trap  & trace  court  orders.  Title  III  interception  orders  etc. 


ft  is  important  to  distinguish  now  what 


is  meant  by  “sniffing.”  The  problem  of  discriminating 


between  users’  messages  on  the  Internet 


is  a complex  one.  However,  this  is  exactly  what 


omnivore  docs.  Ir  docs  NOT  search  rhrough  ft.  contents  of  every  message  and  eol.ee,  those  that 
contain  certain  key  words  like  "bomb"  or  “drugs."  I,  selccrs  messages  based  or.  criteria  expressly 
ser  out  in  the  court  order,  for  example,  messages  transmitted  to  or  from  a particular  account  or 
or  from  a particular  user.  If.hr,  device  is  placed  a,  some  poim  on  the  network  where  it  cannot 
discriminate  messages  as  set  out  in  the  court  order  , i,  simply  lers  all  such  messages  pass  by 


unrecorded. 


One  might  ask,  -why  use  Carnivore  a,  all?"  In  many  instances,  ISPs,  particularly  the  larger  ones, 
maintain  capabilities  which  allow  them  to  comply,  or  partially  comply  with  lawful  orders.  For 
example,  many  ISPs  have  the  capability  to  “done”  or  intercept,  when  lawfully  ordered  to  do  so,  E- 
marl  to  and  from  specified  user  accounts.  In  such  cases,  these  abilities  are  satisfactory  and  allow 
full  compliance  with  a court  order.  However,  in  most  cases,  ISPs  do  not  have  such  capabilities  or 
cannot  employ  them  in  a secure  manner.  Also,  most  systems  devised  by  service  provide*  or 
purchased  "oil  the  shelf"  lack  the  ability  to  property  discriminate  between  messages  in  a fashion 
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that  complies  with  the  court  order.  Also,  many  court  orders  go  beyond  E-mail,  specifying  other 
protocols  to  be  intercepted  such  as  instant  messaging.  In  these  cases,  a cloned  mailbox  is  not 
sufficient  to  comply  with  the  order  of  the  court. 

Now,  I think  it  is  important  that  you  understand  how  Carnivore  is  used  in  practice.  First,  there  is 
the  issue  of  scale.  Carnivore  is  a small-scale  device  intended  for  use  only  when  and  where  it  is 
needed.  In  fact,  each  Carnivore  device  is  maintained  at  the  FBI  Laboratory  in  Quantico  until  it  is 
actually  needed  in  an  acti  ve  case.  It  is  then  deployed  to  satisfy  the  needs  of  a single  case  or  court 

order,  and  afterwards,  upon  expiration  of  the  order,  the  device  is  removed  and  returned  to 
Quantico. 

The  second  issue  is  one  of  network  interference.  Carni  vore  is  safe  to  operate  on  IF  networks.  I t is 
connected  by  a high  impedance  bridge  and  does  not  have  any  ability  to  transmit  anything  onto  the 
network.  In  fact,  we  go  to  great  lengths  to  ensure  that  the  Carnivore  is  satisfactorily  isolated  from 
the  network  to  which  it  is  attached.  Also,  Carnivore  is  only  attached  to  the  network  after 
consultation  with,  and  with  the  agreement  of,  technical  personnel  from  the  ISP. 

This,  in  fact  raises  the  third  issue-that  of  ISP  cooperation.  To  date.  Carnivore  has,.  to  my 
knowledge,  never  been  installed  onto  an  ISP’s  network  without  assistance  from  the  ISP’s  technical 
personnel.  The  Internet  is  a highly  complex  and  heterogeneous  environment  m which  to  conduct 
such  operations,  and  I can  assure  you  that  without  the  technical  knowledge  of  the  ISP’s  personnel, 
it  would  be  very  difficult,  and  in  some  instances  impossible,  for  law  enforcement  agencies  to 
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successfully  implex  a„d  ^ ^ fc  ^ 
also  depends  upon  the  ISP  personal  »A , „ , 


particular  networks. 


wu‘w  wra  me  stnct  taWKW  of  an  interception  order.  The  FBI 
personnel  to  underst  and  the  protocols  and  architecture  of  their 


Auofher  primary  consideration  for  using  Carnivore  is  data  integrity.  As  you  know.  Rule  90!  of  the 
Mora,  R„,es  of  Evidence  require  the  aufheniiclion  of  evidence  „ . fc  ^ 

admissibility.  The  use  of  the  Carnivore  system  hy  .he  FBI  to  intercept  and  store  comnmnications 

provides  for  an  undisturbed  chain  of  custody  by  providing  a witness  who  can  testify  to  the 

retrieval  of  the  evideuce  and  the  process  by  which  i,  was  recorded.  Performance  is  aiso  a hey 

reason  for  .he  use  of  Cantivore  over  commercial  sniffers.  Unlike  commercial  software  sniffers 

Carnivore  is  destgned  to  intercept  and  record  the  se.ee, ed  communications  comprehensive, y.  ’ 
without  "dropped  packets." 


rn  conclusion,  1 wauid  like  to  say  tha,  over  the  last  five  year,  or  more  we  h ■ 

yeafs  or  more>  wfe  have  Witnessed  a 

commurns,  steady  growfh  it,  instances  of  compute, -related  crimes,  including  traditional  crimes 

and  terrorist  activities  which  have  been  pianned  or  carried  out,  in  part,  using  the  Internet.  The 

aMity  of  the  law  enforcement  community  to  effective  investigate  and  prevent  these  ^ 

P-.  dependant  upon  our  abiiity  to  iawfiriiy  eoitoct  evidence  of  wrongdoing.  As  the 

ecomes  more  comp, ex,  so  do  the  changes  piaca,  on  us  to  ^ pace.  We  couid  no,  do  so 

-on,  the  continued  coopemtion  of  our  industty  p»„ers  and  innovations  such  as  the  Carnivore 
software^ 


i and  innovations  such  as  the  Carnivore 
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fc  forward  to  working  with  the  subcommittee  staff  to  provide  more  information  and  welcome 

>our  suggestions  on  this  important  issue.  I will  be  happy  to  answer  any  questions  that  you  may 
have.  Thank  You. 
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sjf,con?m5tte®  be  » or^er-  And  it’s  probably  going  to  be  necessary  for  the  staff  to 

close  the  doors,  otherwise  we  11  have  noise  from  the  hallways.  3 u 10 

In  recent  years,  with  the  growth  of  the  Internet,  the  FBI  has  encountered  an  increasing  number  of  criminal 
sfcrims  3tIOnS  m W UC  5 cnmxna  subiects  have  used  the  Internet  to  communicate  with  each  other  or  their 

.belieyes  m?ny  toemet  sendee  providers  lack  the  ability  to  discriminate  between 
communications  in  order  to  isolate  the  specific  types  of  information  that  may  be  authorized  to  be 

SabS  five  iS/tolSS?  *?*  ^ d»signed  and  deve?°Ped  a program  called  Carnivore  which 

enables  the  FBI  to  isolate,  intercept  mid  collect  communications  that  are  the  subject  of  lawful  orders. 

6 Came  r April  duriR§  {esttimony  bef*re  *he  Subcommittee  on  the  Constitution 
rnl  n^5,^.R°b  rt  Com;R®vere>  who  represented  an  Internet  service  provider  that  tried  to  resist  attaching 

the  Carnivore  program  to  its  network.  <uuu,mug 

rewSo  !nSt!rer!!Sd?at  °”?  °f*e  na!tipns  ^fg«st  Internet  service  providers,  Earthlink,  Inc.,  has 
access  servers'  to  Sl5? S net%v?rk  because  attaching  the  program  m the  past  caused  its  remote 

Other  ISPs  have  stated  publicly  that  they  would  challenge  an  order  to  attach  to  their  networks. 

While  these  industry  officials  have  expressed  willingness  to  cooperate  with  law  enforcement  to  comely 

w Jfcj  C0Uft  » concerned  about  the  effects  attaching  Carnivore  to  their  network^ 

" ill  have  on  the  security  of  their  infrastructure  and  the  privacy  of  their  customers. 

°n  My  1 2>  Attorafy  General  Re™  stated  that  she  does  not  want  Carnivore,  quote 
to  be  a tool  that  is  m any  way  a cause  of  concern  for  privacy  interests,”  close  quote.  Today's  hearing 
provides  federal  law  enforcement  the  opportunity  to  address  the  privacy  concerns  that  have  been  raised. 

unreL^^  tiie  ^u,esti°a  as  t0  whether  existing  statutes  protecting  citizens  from 

lawS^  mder  the  Fourth  Amendment  appropriately  balance  the  concern  of 

StSSfi.  * d J*"  enforcement  is  concerned  that  the  information  needed  to  keep  the 

public  safe  remams  available.  Individual  citizens  are  concerned  that  a sufficient  degree  of  privacy  and  the 

232 ^eSfofoSLSSSf  ’ 1 b£  b u T °{mod*m  cnmmunieatiofs  and  ^formation 

?£3® V « hon  that  may  have  traditionally  been  kept  in  a file  cabinet  at  home  is  now 

foSest  I y by  a t Urd  pErty  “ cyber5pace- 1116  hearing  today  will  also  address  this  balance  of 


*e  Use  ofGarnivore»  h is  important  that  our  deliberations  be  based  on  facts  and  not 


~“W  *"  «*»««««•  ftaPUon, 


I look  forward  to  hearing  from  all  of  our  witnesses  today  and  Fd  now'  recognize  Mr.  Watt. 
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WATT:  Thank  you,  Mr,  Chairman, 


I confess  that  up  until  about  10  days  to  two  weeks  ago,  I had  paid  very  Hale  attention  to  this  whole 
Carnivore ! project, ( And  at  about  that  point  I started  to  get  inquiring  telephone  calls  from  the  media  and 
press  about  what  I knew  about  Carnivore,  I don't  know  much  more  about  it  today,  and  that's  whv  I want 
to  start  by  praising  the  chair  of  the  subcommittee  for  con  vening  this  hearing,  because  I agree  with  the 
chair  that  whatever  information  we  have  and  however  we  proceed  as  a committee  and  as  a Congress 
needs  to  be  based  on  the  facts,  * “ 

**X  *0  bring  to  this  hearing  a level  of  open-mindedness  to  try  to  understand  the  facts  and  trv  to  figure 

1 ^ What  diSP°Siti0n’ ifany’ m3y  be  required  by  Con^s,  what 

Suppose  I would  be  less : than  honest  if  I didn't  say  that  I have  had  for  quite  a while  a generalized  concern 
about  the  government  s ability  to  invade  the  privacy  of  its  citizens.  There  seems  to  me  to  be  a growing 
mvelof  generalized  concern  about  Big  Brotherism  that  I suspect  is  being  fed  by  the  increasing  electronic 


WATT:  When  the  fourth  Amendment  was  passed  and  put  into  the  Constitution,  there  was  at  least  a 
leelmg  that  if  the  government  came  to  do  a search,  it  at  least  had  to  bring  a warrant  and  present  it  to  you 
or  come  and  fcick-in  your  door.  1 ; 

And  in  some  of  our  communities,  we  have  always  had  probably  an  exaggerated  fear  of  whether  the  latter 
was  likely  to  occur  than  the  former,  and  it’s  probably  from  that  perspective  that  1 have  always  had  this 
kind  of  genera  lized  concern  , J 

* 

But  notwithstanding  that,  1 will  make  every  effort  1 can  to  try  to  be  objective  and  impartial  about  this 

1 rw  ■ e gf  nefai  commen,ts  P°'mt  UP the  context  in  which  we're  operating  and  point  up  the 

importance  of  having  such  a hearing  as  this.  * * 

From  my  perspec  tive  it’s  good  to  see  a number  of  people,  who  as  long  as  the  unwarranted  searches  and 
wiretaps  and  invasions  or  potential  invasions  were  being  visited  on  parts  of  the  community  that  they 

concern 


opportunity  to  look  into  that  and  evaluate  it  And  I welcome  the  opportunity  and  thank  "the  chairman  for 
convening  the  hearing  for  that  purpose. 

Thank  you,  Mr.  Chairman,  I yield  back. 

CANADY:  Thank  you,  Mr,  Watt. 

Mr.  Hyde? 


HYDE:  Thank  you,  Mr.  Chairman. 
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8 Very  ^Portant  bearing,  as  attesfed  to  bv  the  interest  shown  with  so  manv  neoete 


sK?hY'*d  *"***&  - 

solE  “ ^ and  m ProtectlnS  constitutional  rights.  I hope  it  get  a good 

Tliank  you,  Mr.  Chairman. 

CANAD\ ; Thank  you,  Mr.  Chairman. 

Mr.  Conyers? 

CONYERS;  Thank  you  very'  much, 

equivalent  of  wiretaps  on  the  Internet.  onitrcement  would  develop  ability  to  conduct  the 

4 

A 22SRS:  ThVlew?  abom  Carnivore  comes  at  a time  when  there  is  growing  concern  about  how  msm. 
«ad  out  ""*•  ^ « h“  *“  «•  ™ - 

So  where  I come  from  in  the  beginning  on  this  is  that,  are  we  minimizine  the  intervention  „t 
non-mcnmmatmg  communications  of  a target 

enforcement  access  to  the  communication  of  non-targets9  And  I think  this  is  a verv 

that  has  to  bejesolved.  h * mmx  tms  3S  a verT  important  question 

pen-registers,  to  the  pen-register 

the  infonnat^^^S^;^?  ** ^ enforceffient  ca«  ***  * «P«*«P  & get 

PkCe  a-°ngsidetthe  {el^hone  a«d  snail  mail  as  a central  means  of 
enforcement  ~ taw  enfoiSSIS^moS! to be 

f°r  i!leSaI  "”**  “ ^ h°pe  *"  ^ « inspire  witSea°Sigy 
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«^1!*  1 thlIf  ^ *S  is  exactiy  {hc  tyPe  of  approach  that  we  need  to  have  when  we’ 

looking  into  a new  arena  of  your  legitimate  needs  for  surveillance  of  suspects. 


were 


And  I thmk  the  more  the  public  knows,  the  more  the  Congress  knows,  and  the  more  light  that  is  shed 
flS!tJ^entS,te  WJ 1 be  ,rendered-  A*d  so,  I do  believe  that  the  FBI  has  engagedTn  this 
well  as  that  of1he™S’s°n  t0°  ’ t0  imi?  the  reV‘ew  of  third'  part>'  documents  as  well  ~ or  content  ~ as 

we*SOme,  le£itimate  questions  that  need  to  be  asked.  One,  is  this  new  technique 

XSv  £S^??*Se  */*?*?£ W mt0  m ***“  m 1 did  not  have  when  I was  a United  States 

totally  Lw  en^onmtS'  An  t ^ approval,  we  had  pen  registers,  but  this  is 

reSoLSt^ro J lnTd ■It'thU?C  Cat  tbfhBI  has  t0  s.teP  S'ngerly,  but  we  all,  obviously,  have 
responsibility  to  engage  in  legitimate  law  enforcement  activities  in  terms  of  surveillance 


is  a 
a 


^Another  way  to  phrase  die  question  is,  who  reviews  and  controls  the  appetite  of 
Carnivore?  I think  that  that  is  really  what  the  purpose  of  this  hearing  is.  iP 

;^d5*wf  §°f  to  the  new  arena  of  privacy,  I think  we  all  have  to  recognize  how  complex  this  i 
ent tretv.  Arco  far  fhaf  I u«}«t  tA  * - 


is  m its 
ve 

Government 


yel  ,hey  s,i"  c*a  * pnvacy  fa *•  «“*»«*» 


lawdeXrce5?nn«C(f^°SfS  resP°»sibUi«es  of  the  commission  would  be  to  review  the  activities  of 

taw  enlorcemtot  in  terms  of  pnvacy  and  its  impact  on  privacy.  So  it's  not  just  commercial  bm  if«  .)« 

S^SToo^atnot  hfir^ e?forCemfenva  br«ad:rarighig  privacy  commission.  And  this  is  one  thing  that 
kro  the  lm  cemu^.  3fy  fa$hl<>n‘ but  iR  a steady*  {houShtfu?  feshion  and  set  the  tone  as  we  enter 

So*  with  that*  Mr,  Chairman,  I want  to  again  thank  you, 

I look  forward  to  the  testimony  of  the  witnesses* 

CANADY:  Thank  you,  Mr,  Hutchinson* 

The  gentleman  from  Alabama  is  now  recognized  for  five  minutes* 

BACHUS;  f thank  the  chairman, 

l^A^A  0b:rsfy  ,wbat  wf  have  here  is  that  technology  has  outrun  the  Jaw.  We  have  a Internet  exnlosion 
I have  two  concerns  that  I would  express  to  you.  One  is  that  we  have  a balance  between  legitimate  law 
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Skncemen£  ReCdS  8nd  thC  ri§ht  ofprivacy’ that  we  **y  to  mamtain  that  balance,  which  is  a delicate 


The  second  is  that  we  have  a balance  between  our  different  types  of  communications.  Because  if  we  have 
certain  types  of  communications  where  we  ha  ve  the  potential  to  monitor  everything  that  goes  through 
fS  wuhar6  ?lhertypf  ofcommumcations  drat  we're  limited  in  our  surveillance,  criminals  are 
wn  bc$e  firf  °nCS  t0,f*Sure  out  what  13  tbetr  safest  mode  of  communications.  And  sooner  or  later 

tvpeotou^  t>Te  °ftCOmrnUnfC3?°?S  but  n0t  a !ot  ofre^ctions  in  another 

to  of  co^SSka  * CnmmaIs  are  «om^ to  raove  t0  the  least  restricted  or  the  least  monitored 

/ 

And  of  course  we  ve  got  to  ask  ourselves  what  level  of  monitoring  do  we  as  a country'  want  to  have  on 
private  conversations,  to  achieve  what  level  of  surveillance?  ? on 


v^nrW  ’nf'^  !tme  blve  y°V  an  example.  Today  - and  tins  is  an  example,  sort  of,  quote,  "from  the  old 
nackf *°da%  co,msng  wie  country,  Federal  Express  packages  are  randomly  opened,  UPS 
packages  are  randomly  opened,  but  U.S.  marl  is  not.  1 mean,  the  mail  is  not  opened.  Now  criminals  have 

“V??  the.fa^st  way  of  «?ai5to§  something  in  the  United  States  is  not  UPS  or  Fed  Ex 
or  pared  post,  use  the  U.S.  mail.  The  same  going  out.  They've  adjusted.  They  found  out  where  the 
loopholes  are.  They  found  out  where  the  least  surveillance  is,  and  thev've  gone  with  using  the  U S nHl 
to  send  things,  because  they  are  not  randomly  checked.  ' 8 Smg  mt  Ub*  nm] 

oJfn^mr  alS  2re  P*0#  t?„fi8urc.out» sooner  or  later,  I would  think  - and  my  question  to  vou,  aren't  thev 
gomg  to  figure  out  — the  illustrations  you  have  given  us  is  that  you  can  take  a work  like  "bomb ” anr!  vm\ 
can  search  the  internet  for  bomb.  Well,  aren't  our  criminals  - aren't  terrorist  toLtfnce,  St  Sev 

! »KCa  1 10  USe  1 je  word  "bomb?" 1 mean*  won't  they  figure  out  to  use  the  word 

ot£  wo^PWo5t  ' ASt°PP0Selt0  exp!osive  device>  won't  they  come  up  with  some  kind  of 

ba£ah?f^  3 W3y-’  bey°rR,d  y0\USing  k?y  words> t0  get  around  *is?  And  vou’re 

oasjcauj  left  on  sweeping  the  conversations  of  law-  abiding  citizens?  How  do  vou  net  around  crimindc 

s^m.  8°mg t0  ?t  10 tWS SyStem? Pney're go5ng ‘° be^e a* *o adaPt, tohlttomZ Sethk 

jAad  at  the  same  time  my  other  concern  is  this;  I've  heard  all  sorts  of  assurances  that  this  won't  fall  in  the 
8 bandt  t?at  t iere  are  safeguards.  Well,  today  there  are  safeguards  on  FBI  files.  FBI  files  only 
certain  people  have  access  to  those  files.  Only  certain  people  can  have  possession  of  those  files  Only 

?anJook  m,*j}ose  fl5es*  Yet  a few  years  ago,  we  found  out  that  1,000  of  those  files  were 

where  we* h^1  TiffS  do  weJ»VC  *at  we're  nQt  8o5“8«>  have  another  situation  here 

\here  we  have,  like  FBI  files,  that  they  got  out  of  the  restricted  area  and  that  people  viewed  them  and 

perhaps  utilized  them  for  things  they  weren't  intended  to  be?  P P em  and 

thev've  SdSSSf fe*  t-atAuaVe  ab0ut.mS  a8entswho  pull  people's  income  tax  forms  and 
me>  ve  used  them  to  go  up  against  their  wives  m court  or  their  ex-wives  on  child  sunnort  matters  or 

£SC?faga!f  someone  who  was  dating  their  girlfriend  to  try  to  embarms  them.  And  there've 

^ * asfured  would  nm  Sf  affS  dlf  Wltb  fi,f  or  what  confidential  infomiation,  which  we 
their  ? d i?!  f 1 ~ d be, restricted,  where  someone  used  those  files  witliin  the  IRS  to 

uieir  advantage  or  to  embarrass  someone  else. 


intended. 


S/24/02  Release  - Pale  52 


V/OrAA  t Pi.f 


1EXIS^NEXI$$ 


ht^^/webJexis-nexis.com>%*uj^^,d5^)bc005a45 1 79276f6fa«72  f516fs477 


i:* 

• •&■ 


So  I'd  ask  you,  how  would  this  be  any  different?  How  is  this  any  different  from  IRS  information  which 
toJ“  would  not  be  disclosed  and  has  been  in  any  number  of  cases?  How  is  this  any  different  from 
FBI  files  who  found  themselves  being  used  for  political  purposes? 


Thank  you. 


CANADY:  Thank  you. 


We  w'iJJ  now  move  to  hearing  testimony  from  our  first  panel  Our  first  panel  will  address  the  Federal 
Bureau  of  Investigation’s  Carnivore  program  and  its  role  in  federal  law  enforcement  in  the  digital  age. 


On  this  panel  first  we  would  like  to  welcome  Dr.  Donald  Kerr.  Dr.  Kerr  is  an  assistant  director  of  the 
Federal  Bureau  of  Investigation  and  director  of  the  FBI's  Lab  Division,  which  develops  surveillance 
and  tactical  communications  technologies. 


Next  we  will  hearing  from  Larry  Parkinson,  the  general  counsel  for  the  FBI. 


Following  Mr.  Parkinson  will  be  Kevin  V.  DiGregory,  Mr.  DiGregory  is  deputy  associate  attomev 
f?ne£^,at  &e  Department  of  Justice.  Two  members  of  the  Justice  Department's  Computer  Crimes  unit  - 
Mr.  DiGregory  is  joined  at  the  table  today  by  Christopher  Painter,  the  deputy  chief  of  the  Computer 
Crime  and  Intellectual  Property  Section  at  the  Depai  tment  of  Justice.  Mr,  Painter  will  not  be  making  a 
separate  statement,  but  will  be  at  the  table  with  Mr.  DiGregory  to  answer  questions. 


I want  to  thank  each  of  you  for  being  with  us  here  today  and  for  patiently  li  stening  to  our  open  ing 
statements.  I would  ask  that  you  do  your  best  to  summarize  your  testimony  in  five  minutes  or  less, 
although  I don’t  think  anyone  will  insist  on  strict  adherence  to  the  five-minute  rule.  And  without 
objection  your  full  written  statements  will  be  made  a part  of  the  permanent  record  of  today's  hearing. 


Dr,  Kerr. 

KERR:  (OFF-MIKE)  grateful  for  the  opportunity  to  discuss  with  you  our  program  for  interception,  lawful 
interception,  of  information  on  the  Internet  and  data  networks. 


As  you  know,  the  use  of  computers  and  the  Internet  has  grown  rapidly  and  has  been  paralleled  by  the 
exploitation  of  computers,  networks  and  databases  to  commi  t crimes  and  to  harm  the  safety,  security  and 
privacy  of  others.  Criminals  use  computers  to  send  child  pornography  to  each  other  using  anonymous 
encrypted  coramimications.  Hackers  break  into  financial  service  company  systems  and  steal  customers' 
home  addresses  and  credit  card  numbers.  Criminals  use  the  Internet's  inexpensi  ve  and  easy 
communications  to  commit  large-scale  fraud  on  victims  all  over  the  world.  And  terrorist  bombers  plan 
their  strikes  using  the  Internet. 


Investigating  and  deterring  such  wrongdoing  requires  tools  and  techniques  designed  to  work  with  new 
and  evolving  computer  and  network  technologies.  The  systems  employed  must  strike  a reasonable 
balance  between  competing  interests:  the  privacy  interests  of  telecommunications  users,  the  business 
interests  of  service  providers,  and  the  duty  of  government  investigators  to  protect  public  safety. 


ft 
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LTtaS  3*£  »? Pv ™ mSSfo^r^'^  */  T Sf,??mk  mail  ^era*™. 

Wts,pm*^ 

iittS’abouuie^ Carnirore^Sf  ^ what?s?t  h*™  ?'  w'c?n™unicslio”s  ■»  requires  me  to  talk  a 

some  in  the  networicitig  industry  wuld  ra!U  pack«?u!fR?ttat  k sometSi^hSo ^ f “ch  ®*  "’ha< 
packets  using  the  addressing  mformatinn  ftf  th*  i ^ sometlmg  a^le  t0  P10^  out  those 

gtajacc^Votteb^^^^ 

that's  passing  through  that  service  provider's  portal  oraerto  get  a part  of  the  traffic 

£?£  2m  WC  requke  a court  order-  court  order  is  specific  to  the  numbers  we  can  tarnet  if™, 
in  feci,  full  °f& peR‘register’  trap*arid  “ace,' or, 

not authorizeVb? a court°order t?*® °f  Surveillance with this s>'stem-  That’s 

wK  f aSk’ 

Second,  we’re  able  to  also  sort  on  the  "to”  and  "from"  line  of  the  e-mail  Ar„t  ,,  , ' , , , 

about  that  is  think  about  the  piece  of  standard  mat!  mat ifs  l^Sk *1  °!f  besf  wa>Jt0Lthmk 

autb^edtoopTh^ 

what  Mwanld t*all0WS  US  {?/e^'er  coment> we>re  ahle  to  open  the  envelope  And  in  this  case 
wnat  we  would  then  do  is  capture  all  of  the  packets  that  relate  to  that  e mail  uZ71t*  ' 

soble  medium  - magnetic  .ape  or  some  other  stable  medium  - for  iaS^semWy .SkX’ 

technical  people  from  the  Internet  service  provide?  ’ d’ m vcry  case*  b>' ORC  or  more 

place,  is  not  !ecords 5 »*»  or  puts  the  system  in 

^nsibirbaWy  alS°  - ***&  technicta^&^rfyK^ 


Sadt^rter?  * **“ ****  °R  SitC  Until  it<s  recorded  and  ^turned,  either  to  a field  office 


or  to  us  at 


And  the  installation,  to  put  a picture  in  your  mind,  looks  very  much  like  a desktop 


Oof  76 


personal  computer.  It’s 
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often  bolted  into  a rack  like  other  equipment  at  the  Internet  service  provider  location  but  an  ,*mnnrtant 
difference  is  that  it  has  no  keyboard,  no  mouse,  and,  in  fact,  it's  looted  up,  as  far  L L “nSS? 
SSfTi  wb?fe-tbe  magBehc  media  are  written,  because  this,  in  fact,  is  the  first  step  in  the  evidential 
rnfwffifdtS0  $ ®imPortanttha|, !t  be  locked,  access  only  provided  to  an  agent  who  comes  on  site  to  ° 

a"d  ,reat!  k j“ lite  we  ““  phy8ical  evM«* ta  <™»  »f 

An  important ^further  point  is  that  we  produce  a record  for  audit  of  the  filter-sett  in  2 and  the  ermfiatw-ni™ 

ZSJS^  ^ the  *“**  Pew  tbnes  ^at  & was  used*  that  was  done  by  the  people  doing  the^ 
installation.  We  ve  now  grown  concerned,  because  of  discussions  that  have  beenongoing  that  we  record 

trieVto^Sfe0!??  5t,rffhnGtlCated’  ffd  so  we  now’ & fact*  override  it  with  a hash,  so  that  if  someone 
tried  to  rewrite  that  audit  trad,  that  could  be  detected,  someone 

*"'•  ’,econ,'s  part  «•*  «*-*» —i 


dvH«nS2f<^h«f  L^vt  k ^ T-o  r mSUSfvTd  110  ?nishou]d  that  There  are  both  criminal  and 
federal  fe  mw  ?,K  £. » ^ ® ar!r  hhct™mc  Communications  Privacy  Act  installations.  It's  a 
tvdera!  felony,  calling  tor  a prison  term  of  up  to  five  years,  a fine,  plus  possible  recovery  of  civil 


And  so  I don’t  think  our  technical  teams  installing  these  devices  are  going  to  risk  their  lobe  thoir  .Worn,, 
and  their  future  by  attempting  to  operate  this  equipment  improperly  ft  th?  ISP  j mtegnty 

installadon  £f  foS? w*  '?’Ch* We  « fect  the  busfiss  ^crests  of  the  service  providers:  every 
StefeS To  d°o  it 


as  raany_°f  the  laige  ones  do,  ro  ftiey  can  respond  to  tte 

ordhr  aTlue°r  {kem,to.do  tbat  and  simply  provide  us  the  information  which  is  the  subject  of  the  court’ 
order  and  we  never  do  install  our  equipment.  We  also,  in  those  cases,  bear  some  part  of  the eoS of doing 


Sirnrtm?  SIS*8, 1 th?  **?  «“«»  numbers  of  them  estimated  in  the  United  States  at  the 
SEfISK  b US,UpWardoliP’0,00/  not  ali  Jarge,  listed  companies.  Some  of  them  are  mom 
sophistication  th?r4°n  1 ha!C  laJF  am0imtS  °f! equipment  and  a great  deal  iff  technical 

SSrt  oSilf  ^ SltfS?*  ne^orf  • 11  fty  recdves  information  tlirough  the  filler  as  authorized  by  die 
h ifan?^  md  norCOITimui?5Catlons  over  the  network.  So  we  don’t  believe  that 

e-mail  to  customers.  rf  th  the  pr0per  functl°nmg  of  the  service  provider's  equipment  delivering 

tb?rLSment* iS  remo.v.ed  *»»n«iwteiy  «pon  the  expiration  of  the  court  order.  It  does  not 
oC to  leave  ftS^koe  P ^ 15  ^ any0ne who  caa  get  b *»d mak«  a decision  on  their 
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&cia  U1  tflc  loun  orQer-  m a sense,  it  s automatic  minimization  up  front, 

Mofficetm . tataZtenlf! « w*h  15  • J1ien  ?>'  m«saS«  are  reassembled  back  at  the 
shoal**.  ifs,  in  SlSSafteS:  faCt'  1DCOrKM,y  or  “dvertendy  captured  tafomtation  we 

And  it  s really  no  different  than  the  minimization  that  occurs  first  real-time  on  a Title  Iff  wm»tan  ^a  *u 
subsequent  on  the  recording  of  that  wiretap  to  be  sure  there's  nSJ th£e  St  shSulStb?  P *“ 

RpwJa^ewJeoce  with  an  appropriate  first  step  in  the  chain  of  custody.  We're  trying  to  maximize  the 
opportunity  to  properly  gather  evidence,  authenticate  it  and  foe  able  to  testify  that  «2X  1 . 

nor  subtracted  nor  altered  that  which  we’ve  captured.  ^ e Vfi  neither  added  to 

toSfh  befauSf lts  3 c°rnbination  of  software  and  hardware.  And  so  we  can  in  fact  adjust  it 

to  fit  subsequent  court  orders,  and  we  can  move  from  one  case  to  another  with  it.  ’ J 


5Sd  SKSlS  ^ °fCOmmerCiaI  SOfhV2re  t0  reduce  risk  and  «»*,  and 


as  I mentioned  before. 


Finally ; one  of  the  things  were  going  to  do,  as  a consequence  of  our  discussion  over  the  w I s m(W,kr 
with  people  in  industry,  staff  and  members  of  Congress  five  of  the  nZrtZt  8 momhs’ 

number  of  US.  attorneys  some  1 5 federal  and ^ut  *L£ « ,pai1ment  of  Jl!Stlce  components,  a 


thafwe  n?eaw'w!f-S  rif!<now  *?  «ad«rtalce  an  independent  verification  and  validation  of  the  software 
w Se'  * ? re  8°,n8t0  do  « with  academic  members  of  the  team  as  well  as  industry mfmW TS 

SBoSSgomstoc“f^ 

w.11,  m ft*,  do  those  things  ft*  we  Jy  it  will  SSL 

Our  year-to-date  use  of  this  tool,  that  is  this  present  year — the  first  three  mzarrm  nCtk«  * 

deployed  it  some  16  times.  It’s  been  used  sixcnminll Sscs  mdm 

ofthose  were  simply  pen-registers,  some  involved  Ml  content.  None  of  those  cases  have  been  b 

numbefftls  reoortSIn  th^ t0  dfta?ls  ,toda>'>  but.r  probably  of  interest  that  it’s  not  a very'  large 

aSP-l^ 

and  to  target  it  precisely  and  well  at  those  that  the  court  orders.  authorized  to  use  this 
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Thank  you  very  much,  Mr.  Chairman. 


CANADY:  Thank  you  very  much. 


Mr.  Parkinson? 

P ARKJNSON:  Thank  you,  Mr.  Chairman.  I do  not  have  a prepared  statement.  PH  be  very  brief. 


I want  to  echo,  first  of  all,  what  Dr.  Kerr  said,  and  this  is  ~ despite  its  unfortunate  name,  this  is  a tool  that 
is  very  surgical.  And  I think  Representative  Hutchison  had  it  right,  that  this  really  is  a minimization  tool 
And  PH  leave  the  technical  aspects  to  Dr.  Kerr. 


What  Pm  here,  primarily,  to  emphasize  and  Pm  delighted  to  be  here  and  answer  any  questions  that  the 
committee  may  have  --  is  to  emphasize  that  there  --  the  FBI  and  the  Department  of  Justice  have  a true 
commitment  to  the  rule  of  law.  And  I want  to  respond  just  briefly  to  the  notion  that  we  have  deployed  this 
system  without  controls  or  without  proper  authorization.  That  is  simply  not  the  case. 


P ARKINSON:  We  are  also  not  saying.  Simply  trust  us,  we're  the  government.  I think  we  have  - we're  not 
naive.  We  have  - we've  had  enough  situations  in  the  course  of  our  history  to  know  that  that's  not  enough. 
We  have  significant  oversight,  both  within  the  bureau,  within  the  Department  of  Justice,  and  most 
importantly,  within  the  judicial  branch  that  overseas  deployment  of  this  device  and  any  other  surveillance 
device. 


In  addition  to  that,  we  obviously  have  vigorous  and  appropriate  congressional  oversight. 


So  that's  why  Pm  here.  Pm  happy  to  answer  questions.  And  I just  want  to  emphasize  to  you  and  to  the 
American  people  that  this  is  a tool  that  is  deployed  rarely  and  it  is  never  deployed  without  a court  order. 
And  we  do  not  deploy  it  in  a way  that  exceeds  the  court  order. 


It  is  very  discriminating,  and  I hope  that  this  gives  us  the  opportunity  to  explore  that  and  give  some 
comfort  to  the  committee  as  well  as  to  the  American  people. 


Thank  you  very  much,  Mr.  Chairman. 


CANADY:  Thank  you,  Mr.  Parkinson. 


Mr.  DiGregory? 


DIGREGORY;  Thank  you,  Mr.  Chairman. 

Mr.  Chairman  and  memb  ers  of  the  subcommittee,  thank  you  again  for  allowing  me  th  is  opportunity  to 
testify  about  the  law  enforcement  tool.  Carnivore,  and  the  Fourth  Amendment. 
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We  have  seen,  as  Dr.  Kerr  has  noted,  magnificent  growth  of  the  Internet  over  the  last  1 0 years  and  it  has 
^tL^S^r“Ze"S- 0Ur  bUSinKSK  and  for  *»d  « ««» to  hold  Edti 

The  Internet  has  spurred  a new  and  thriving  economy.  Many  businesses  have  prospered  by  providing 

imnmvftfoTS?1?  ^T-^irri^!1  the  Internet.  Others  have  assisted  in  the  building,  maintaining  and 
anf  ^ Internet  has  given  people  jobs,  supported  families  and  communities, 

Sr ^ Kss/ ,or  ^ fcrthe  worid- The  totOTa  hM  ^ 


J >7  7 — tiiia  lUfctwiVOi  UHUl,  J&VCn  1H  ttlC 

short  existence,  we  have  seen  a wide  range  of  criminal  use  of  this  technology.  It  has 
besn  used  to  commit  traditional  crimes  against  an  ever- widening  number  of  victims, 

toem«7tself  th0Se  Cnmraa!s  mtent  on  stt2ckin8  and  disrupting  computers,  computer  networks  and  the 

In  short,  although  the  Internet  provides  unparalleled  opportunities  for  Americans  to  freely  exnress  ideas 
ualso  provides  a very  effective  means  for  ill-motivated W>ns  to  breach  the  pricey  and  seSJ  of 

woarld  &£???“  **K  df in  W S WOr!4  are  be«^S  to  appear  in  the  online 
Memet  * ^ ’ extortIon>  fraud’  ldem!{>r  <**&  ^d  child  pornography  are  migrating  to  the 

* 

2fofc™  addressing  pri  vacy  and  public  safety  serve  as  a framework  for  law 

?h5S  n5w  forumfor  cnrainal  activity.  If  law  enforcement  fails  property  to 

eroded*  ^S^lSnS^S  ! m!fSt,gf1Ve  ^clmiques  the  public’s  confidence  in  government  will  be 
eroaen,  evidence  will  be  suppressed,  and  criminals  will  elude  successful  prosecution. 

* t00/'mid  ij?  responding  to  cyber-crime,  however,  we  will  in  effect  render 
authorized  govemmcT sSl-eSKe  to  °°”“n™icate  and  «*  «i™  without  fear  of 

Proper  balance,  Mr,  Chairman,  is  the  key. 

hd5  SSSI?^SSCarfllVOr",  *• tmth  °f  1 the  matter  is  tiiat  Caf  aivore  is> in  «•»*  2 tool  that 

our  obligations  to  the  public  to  enforce  the  laws  and  preserve  public  safety,  we  use  the  same 

attStTon  toe!?5S  T*  ^Hods  online  as  we  do  in  the  physical  world,with  the  same  careful 

auention  to  the  strict  constitutional  and  legal  limits  feat  are  imposed  upon  us. 
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Carnivore  xs  simply  an  investigative  tool  that  helps  os  to  investigate  online  in  the  same  wav  a.  in  ih, 
enter,03  ^ d 3nd  Cn8b  £S  US  t0  °btak  °nly  the  ^formation  ^ are  authorized  to  obtain  through  a Jourt 

To  illustrate:  Law  enforcement  often  needs  to  find  out  from  whom  a drug  dealer  for  instance  i« 

is  •** his  “ is  “ ~ <i  £22. 


2K52u . ao,cS“h“s  ",e  ™amm  °u  ,r*p 

°r  * Chil<!  I’om  Whw  ”“y  *»  j>'a  “S  Italy  <0  an  e-mail  as 

253  tSI  a?ffm?cra^ntrUfS  a !rap  ^id  traceo/  a pen-register  in  the  online  context,  however,  we  have 
toirnd  that  at  times,  the  Internet  service  provider  has  been  unable  or  even  unwilling  to  stmnlv  thie 

mfonnation.  ft  is  for  tlxat  narrow  set  of  circumstances  that  the  FBI  designed  Carnivore  Law  enforcement 

Sf1^  responsibility  to  protect  public  safety  simply  because  technology  has  changed  RaS 

mfe?afestot!e£ly  7?  eforcenfRt  will  continue  to  be  effective  as  criminal  actfvdn'  ’ 

migrates  to  the  Internet  W e cannot  do  this  without  tools  like  Carnivore, 

SdSand  ^vA2S^?>eC*lf  flherhl8,t0oi  7at  can  «ather  the  Mfonnation  authorized  by  a court 
onlfxhet  f i!tn‘ 1 pemHtS  law  enforeement,  for  example,  to  gather,  pursuant  to  an  order 

Sv  humSS SntdSff‘ ss  °f  Pefons  With  vv'hom  the  drag  dealer  is  commimicating  without  ai  lowing 

outside  the  scope  trf  Ae^court  ^^n-  orcement  or  servicc  provider,  to  view  private  information 


In  other  words,  as  I understand  it.  Carnivore  is  a minimization  tool  that  permits  law  enforcement  i 
ompiy  with  court  orders,  to  protect  privacy  and  to  enforce  the  law  to  protect  the  public  interest. 


Sptariig.15’ 35  Dr'  KeiT  haS  n°te4,  CarBivore  crea!es  ® audi{  trail  that  demonstrates  exactly  what  it  is 


t07s\thereJare  ma»y  mechanisms  we  have  in  place  to  prevent 
enfolSmenrc?nM  Amendment  and  the  courts,  of  course,  restrict  what  law 

SfSSL  aSSX im  M ”,™re’  “ i0  “““"V  of  Title  HI  and 


Sis “f  * “Urts  For  <Wpte, bcfcn, 
digital  display  pagers,  the  requesting  investigative  agency  must  obtain  approval  for  Ife  TitAl 
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application  from  the  Department  of  Justice. 


Specifically,  in  the  Department  of  Justice,  the  Office  of  Enforcement  Onentfonc  in  <k»  r«  • , - 

ZXSZtEEl?"  * 8ira 

Justice  approve  a Title  m reouest  iS™f  T , the  mvestigative  agenc>'  and  the  Department  of 

but  exacting  standanfc  * ^ * o{coarse’ be  aPProved  b>'  proper  court  using  familiar 

violating  Title  m « the  Electmnic  Communication  taSSS?i^Kd«22  f" 

SSS'on1^a^g.“'  F°r  Foimh  TSZSSZSZ*. 

SaSoi liXTS 

puSiclv  Ss2iMaMd  !ofatet« M >»  he  A report  generated  from  the  review  will  be 

"SSt^ssa  Ssty's  aspec,s  of,hc 

DIGREGORY : The  Department  of  Justice  has  provided  the  committee  with  mb  cm  „„.v. 

m.  Painter  and  I are  available  to  try  to  answer  any  of  your  questions  along  with  the  rest  of  the  panel. 

Thank  you,  Mr.  Chairman. 

CANADY ; Thank  you  very  much. 


been  very'  helpful  to  us. 


testimony 


I m going  to  have  a few  questions  and  other  members  will  have  auestiorK  Tdn  ■««»«*  o**u  * * * 

P^Me  m wbSW  Pn>babl,y  "0t  ,he  !hat '«  w*"1  to'i*. » m would  a?k' yi“ i to 

ES J£  • nUm  resP°nses  t0  any  additional  questions  that  any  members  of  the  co imliZtiw 
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Let  nf"  ha.vinS  saidthat* !et  me  §0  over  some  ground  that  l think  you've  already  covered  eon«™;»«  a 
use  of  Carnivore  under  the  pen-  register  or  trap-and-tmee  authority  y concerning  the 

When  you  re  using  the  pen-register  or  trap-and-trace  authority,  would  you  ever  obtain  any  letters  or 

°t  ier  than  {hose  .^at  maJce  UP  an  e-mai!  address,  such  as  MnSmith@home.«>m?  In  other 

autSritv^hil'i  n cuSJa  ihmM  Z°U  eJer  m4ake  3 reciuest> under  tlie  pen-  register  or  trap-and-trace 
authority,  that  included  the  capture  of  words  or  sentences  other  than  the  e-mail  address? 


K£RR:  The  answer  from  our  side  in  terms  of  how  we  set  it  up  is  that  if  it’s  a pen-resister  order  we  onlv 
get  the  two  address  and  we  capture  nothing  else,  8 raer  *e  onY 

PAINTER:  And  I might  say  also  that  the  — even  die  subject  line  we  consider  to  be  content  and  that 

mro^a.ion  ,hai  soi=ly,  J^K.'USho.e 

e-mail  address  when  you  re  using  the  trap-and-trace  or  the  pen-register  authority, 

PAINTER:  In  the  electronic  communications  context,  yes,  that's  correct. 

CANADA  . Let  me  ask  you  this:  in  your  view,  does  federal  law  enforcement  have  the  authority  under  the 
has  visifed?r  ^ l°  CaptUre  S0‘calIed  lJRL  addresses,  which  are  the  addresses  of  the  web  sites  a person 

mSS  2 <L  address  - the  URL  addresses  are  not  really  what's  contemplated  under  the 

f Ute' What  Ku  re  taIbnS  aboul  there  is  ” I mean,  it  could  - it's  possible  it 

smssssr ical,y  KmHs  * ,o  a ^ s 

CANADY:  If  you  would. 

l!Sdlh!i!hat'j  iVeT  gl°?  PTL  tJere,are  services»  such  as  Hotmail,  where  U have  to 
£ Jf  wf,b  faSe  fatten  look  for  the  authenticators  and  other  indications  that  it’s  an  e-  mail  service 

dmftclnture  SS.Sc  5Sh  ^ iTf  t0  Simply  tbe  e*mail  thafs  Provided  through  that  serviced 

web  Sf we  rilrict  whddUf  ^ H f?et* W?,  are”ot  m{erlsted  in  what  they  do  when  they  surf  the 

weo,  ana  we  restrict  what  we  do  only  to  that  e-mail  traffic  over  the  web  page. 


CANADY;  OK, 


Now,  in  your  comments.  Dr.  Kerr,  you  indicated  that  Carnivore  has  been  used  onlv  a few  times  I think 
1 6 was  the  number  for  this  year,  is  that  correct?  y raes' 1 


KERR:  That's  correct;  1 6 times  this  year.  I think  about  a total  of  25  in  the  life  of  the 


program  over  the  last 
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two  years. 


CANADY:  Well,  over  that  same  time  period,  how  manv  Title  III  intereente  nn  ^ mail  «4 
done  not  using  Carnivore?  y intercepts  on  e-mail  would 


you  have 


5™*  used  Ca.rfivo,"e  and  earlier  versions  of  the  same  technology,  and  in  some  other  csw 

commerciarproSuo’ ^CaSTOr^vS  kfecfto eeTsomeofl th” ^ f a!?^hat  J* ®?ved &o» the  ’ 
bnefed  you  on  earlier,  because  tire  commercial  product  had  been  deve topld  quitl  anSr  pt^oS ' 

i 

Fhnfut^  Eketb*sare  us.e£*  hy  the  service  providsrs'to  monitor  the  quality  of  their  sendee  In  that  „„*» 
more dSth!SigS^°°  What  feey  Can  °bscrve- In  our  case>  we*«  limited  and  need  the' 


CANADY:  My  time  has  expired,  but  by  unanimous  consent,  F!1  have  three  additional  rat 


minutes. 


Let  me  follow  up  on  that,  if-  let  me  change,  given  the  limited  amount  of  time,  to  a different  subject. 

SforSmlrif6  >'0u.C0nten5P^ted  allowing  the  use  of  Carnivore  by  other,  not  onlv  federal  law  • 
enforcement  agencies,  but  state  or  local  law  enforcement  agencies?  ’ } Iederalla*  ' 


enforcement  1 we  u,secl  11  on  a{  5easf  one  occasion  m support  of  another  federal  law 

enforcement  agency.  We  have  not  yet  brought  it  to  the  ooint  where  we  kA.h  i.  Ja 
oi  providing  it  to  state  agencies  ' P e wc  wouid  be  5alkm8  ab^  K w terms 


Su2araKSw S&SS”inn^ 1 ref<!™5c.to.a  media  report  that  Earthlink  was  required  to 
cSSnmTo  “ °ne  msto“- Anti  *>“*  *>•  of  i«  outwork  to  Sash  and  i « 

Now,  from  your  comments,  Dr.  Kerr,  I understand  that  that  just  shouldn't  harm? « *m  i;u  u 
comments  about  those  reports  and  what  actually  took  place' there ^ ^ 

Earthlink,  lomng  of  an  ISP,  and  whether  you've  had  other  complaints  simi!a?to  kat  maSy 

^S'et^than  What  nW?-  doi!,try  \°  giv€  you  somelhi»g  for  the  record  that’s  more 

compelled to  mo^ahe?d8S  Ek  V™  f y Wif^  Wen“°  Earthlink  they  were  ultimately 
tried1 to  pm to£a  7 P ^ 10  d° 11  software  that  they  essentially 
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2*2^  & S'^SaSiSS? l0"8  has  Car”lvwe  01  so“ 

ago,  but  in  t Jms  'SlS’crn  orfS^d^l’o^Stlow , IhJhatoTywf™'  *h°W  *"*  !'care 
this  yey  J OTOTmga^g  to  theSj  J'eSf SSoSto”  f 1 6 of  fcm 


WATT.  It  seems  to  me  that  such  verification  would  have  taken  nlsee  tnm.  r _ _ 

rate  pubhc  concern  or  legal  concern,  ak  p ce  at  some  earJser  stage,  not  25  cases 

Jhe  essence  of  the  development  program,  of  course,  is  that  you  do  learn  is  vmt  ,w.t™  * 

WATT:  What  products  - what  properties  did  it  not  have  that  you  were  looking  for? 

KERR:  It  didn't  have  the  same  discrimination  caoabiiities  It  didn't  i™.,  <u„  „„  , ... 

audit  report  and  report  on  configuration  that  sve  require.  ' d “ * h sarae  ablht>' to  Provide  an 

* 

administrative  review.  * quesl,oncd'  “ faCt’  m that  c™stance  than  they  would  be  in  any  internal 


CANADY;  Hie  gentleman's  time  has  expired.  Hie  gentleman  will  have 


three  additional  minutes. 


is  yowaSS™^MfoBpS8ta<SS°, pho nT™^dtS^^<’t^rbcMCO’^my°t 
KERR:  That's  an  area  that's,  in  fact,  in  a state  of  change  today. 


one  company  or 
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WATT:  Who's  changing  it? 


KERR:  Yon  did,  sir... 


(LAUGHTER) 


...  in  that  the... 


WATT:  I think  fve  - you  being  Congress,  I take  it? 


KERR:  Yes,  sir. 


WATT:  I think  I voted  against  this  bill,  as  I recall,  and  still  have 
you. 


some  concerns  about  it,  to  be  honest  with 


But  go  ahead,  I'm  locked  with  everybody  else  for  that  purpose. 
KERR:  Sorry. 


Some  of  my  colleagues  know  this  better  than  1,  but  the 


point  is,  the  Communications... 


gii°“ld  iireCt“g  '°  f*rki"s011'  He's  ,he  8“eral  ““"*1.  He  should  know 

Or  Mr.  DiGregory,  I didn’t  mean  to  beat  up  os  the  technician  here.  Fm  just... 


DIGREGORY*  In  its  most  basis  sense,  as  I understand  it,  the  telephone  tap  is  conducted  at  the  nhnr 

nnmKy  S'?  reStT?ed  t0  th.e  ^ividuaI  Jine  which  you  wish  to  tap.  Whether  you  wish  to  obtain 
numbers  dialed,  numbers  coming  m,  or  whether  you  wish  to  obtain  content. 


y°“  _ h0W  wWl  lh«  CWW»  h»  for 


DfGREGORY:  Now,  well  go  back  to  the  science  side. 

KERR:  Not  to  tty  to  confuse  you  by  switching  back  and  forth,  but  the  telephone.. 
(CROSSTALK) 

WATT:  Fm  pretty  confused  without  you  switching  back  and  forth,  but  go  ahead. 
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sa  sSfSs w bas“  !»««% 

lntercept.  It  s a so-called  packct-swiicfi  ed  So*  S S,  S'?,0fB’  ttat  “Ve  ^ » 

m ortler » *»>*  a phone  call  fora  my  house  to  votm  md  tS  if  f leas“S  « circuit 

conversation,  our  private  circuit.  ' ’ n xm  s>  ” >ou  W‘H,  for  the  time  of  the 

WATT:  Let  me  stop  you  right  there,  because  my  light's  going  to  go  off-  has  already  gone  on. 

luKyTn^ 

(CROSSTALK) 


vi'vjN **> 


fa477 


KERR:  I JI  give  you  my  view  and  then.*. 
(CROSSTALK) 


CANADY:  The  gentleman  has  an  additional  minute. 
KERR: ...  Ill  stand  corrected  by  my  colleague. 


belief,  from  my  perspeftlle^thS  1 ^ ¥s  becayse  of  the  correct 

appropnate  analog  to  the  telephone  number  **  “ ^ 8 USefoI  and 


But  perhaps,  Mr.  Digregory  or  Mr.  Parkinson  would  like  to  add  to  that. 

at?d  k>  appropriate  also  to  point  out  that  there  are  gradations  of 


*f  them's  a higher^  of  atS3SSn  £ d£JZ£^  Vh  T *?**»  «f 
the  courts,  dependmg  on  what  sort  of  intrusion vouS alHnSnm  d.  hl#?r  Ieve35  ofi authority 

e to  move  it  up  a notch  or  several  notches  to  a Title  ffl  authority.  d t0  go  ^yqnd  that  then  w 


tn 


WATT:  Tltank  you,  Mr.  Chairman. 
CANADY:  Chairman  Hyde? 
HYDE:  Thank  you,  Mr.  Chairman. 


privacy.  And  when  you  see  some  of 
to  wonder  and  to  worry. 
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W.licsti™«lh  mfonmUonthM  m> 

later,  mildly  critical  of  what  ke  did,PwMch  doesn't  g»  to  talteS  roproseS°  “ 1 “m,!t  1,5  8 


A JcS$  CDIIip^illlg  C3SC(  I CSSSj  IS  OVCf  the  SO^C^IIcd  PllCfifStS  WllCr£  thf?  I'ltv  wa«nTt  Jtr»nrvtr  J < , . 

ones  sense  of  privacy  was  — took  a heating  T *h™,M  *u&t  a a , u wasn  t breached  at  all,  but 

about  how  th  is  culture  of  pri  vacv~  wSiJSt*  Sffi  Ajld,so’  ?e/e  are  People  who  are  skeptical 
e 01  pm  acj  how  P°rous  * 3S-  doesn't  call  for  an  answer,  that’s  just,  kind  of 


comment 


criminals? 


DIGREGOR\ «.  Well,  I think  that  terrorist  cells  and  organized  crime  can  me  inf  em+t  * «.  >* 

can  use  e-mail  to  communicate  And  simnl  v ih*>  , temet  t0  c^mumcate, 

i&SSffigSg  a“«*  - « ™ edSette^ft"" 

are  being  called  by  the  organized  crime  figure  or  thKgtoffiS"re8BtW  ^ ti0X  nUmbers  *“ 

Sled  infhSS?f  ffa?55as(ins  >'ou  have  for  not  letting  the  Internet  sendee  providers  gather  the 
requested  information?  I take  it  they  have  made  themselves  available  to  do  that  for  tL  r»!^t  t 

some  of  them  haven't.  But  what  are  the  reasons  why  you  don't  let  them  dolt?  * * P ****** 


to  correct  me  if  I’m  wrong  - 


FdS^^?^iil°n  t?mkit,S  a ,question  ~ and  anybody  up  here  is  invited 

1 don  t think  its  a question  of  not  letting  them  do  it,  1 think  Carnivore's  *n  <k 

where  the  Internet  service  nrovider  ic  imiMstn  • < Jr  s tise  is  limited  to  those  situations 

FBI  requires,  puSSo  Crfc  P * *'  m,nIm,zed  com-ordered  tofora.a.ion  lhat  th 

KERR:  And  let  me  amplify  on  that  a little  bit. 


SitSSefyfas£dmS  5S’ Wi!1  aIWayS  Si!0W  the  fatemet  sm'ice  Provider  to  do  it  if  they  can, 


in  fact. 


T a,croally  challenged  ~ now  talking  about  who  tile  ISP 
the  ISP  Pied  to  work  with  their  own  tool,  it  was  not  effective  it  was  not  o»nti»rm«  -it  „#•*(,  ,, V 

was  only  capturing  incoming  and  not  outgoing  addresses.  It  wasn't  giving  the  whole  info^^fokT  r!  -* 
that  case,  the  FBI  was  forced  to  use  the  Carnivore  tool.  8 8 ole  information.  And  in 


was  *•-  and  that  one  instance 


I?a4n*n^t  ^irat  &1®*  ^*e  first  line  is  to  let  the  Internet  service  orovider  do  it  „0  a a - r 

he  FBI  1 believe  would  like  the  Internet  service  providers  to  do  it  if  they  can  y n.  And,  m fact. 


HYDE:  Fine.  Thank  you  very  much.  I have  no  more  questions. 
I m through,  Mr.  Chairman, 

CANADY:  The  gentleman  from  Michigan’s  recognized. 
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CONYERS:  Thank  you  very  much. 


I think  one  of  the  basic  questions  here  is  to  determine  whether  or  not  you’re  minimizing  your  activities  or 
whether  you're  maximizing  them.  And  of  course,  it's  already  been  asserted  that  you're  minimizing  them. 
And  my  job  is  to  find  out,  maybe  before  the  hearing  ends  but  certainly  after  the  hearing,  whether  that  is 
correct. 


And  it  seems  to  me  that  this  system  that  we're  oversighting  today,  unlike  other  trap-and-trace  devices,  or 
the  others'that  we  use,  is  available  for  — is  subject  to  the  maximization  of  information,  getting  more 
information  than  is  required  or  is  authorized  by  a court  order.  And  so  that’s  the  area  that,  to  me,  is  verv, 
very  unclear  as  of  now. 


Tm  not  sure  how  we’re  going  to  sort  this  out,  but  1 think  we  have  witnesses  here  that  are  going  to  come 
forward  later  on  that  are  going  to  complain  about  the  fact  that  there  was  other  information  that  was 
available  through  this  system  that  might  not  have  been  available  if we  weren't  going  through  the  Internet. 


CONYERS:  Isn't  that  possible,  that  you  can  get  more  information,  you  can  look  at  other  things  that  would 
not  have  otherwise  been  available? 


KERR:  One  of  the  points,  Mr.  Conyers,  that  I was  taking  some  time  with  was  to  try  to  make  it  clear  that 
the  only  information  we  can  capture  is,  in  fact,  that  specified  in  the  court  order.  And  to  go  outside  of  the 
court  order,  in  fact,  is  a federal  felony  with  substantial  sanctions  for  those  who  would  do  so. 


We,  in  fact,  think  of  this  as  a tool  that's  designed  explicitly  to  meet  the  requirement  of  the  court  order.  We 
don't  have  the  authority,  nor  are  our  people  allowed  the  opportunity,  to  step  outside  of  those  bounds. 


CONYERS:  Well,  right,  that’s  the  law.  But,  I mean,  that's  the  problem.  1 mean,  if!  could  be  assured  that 
everybody  wouldn’t  do  the  wrong  thing  because  there  was  a statute  making  it  criminal,  that  would  reduce 
a lot  of  our  efforts.  And  even  law  enforcement  people,  I hasten  to  add. 


Mr.  DiGregory? 


DIGREGORY:  Mr,  Conyers,  as  I understand  the  way  the  system  operates  - and  certainly,  that’s  correct, 
that’s  what  the  jaw  is.  But  them  are  checks  and  balances  with  respect  to  Carnivore  which  would  make  it 
extremely  difficult  for  someone  to  counter  those  checks  and  balances  and  violate  the  court  order. 


It’s  not  just  a situation  where,  as  I understand  it,  a rogue  FBI  agent,  for  example,  could  broaden  the 
coverage  of  tire  Carnivore  intercept  and  violate  the  court  order.  In  order  to  do  that,  he  wou  ld  need  to 
engage  the  aid  of  technical  people,  perhaps  even  technical  people  at  the  Internet  service  provider,  and  he 
wfould  also  have  to  fmd  some  way  to  cover  up  or  change  the  audit  trail  that  is  left  by  the  system  so  that  it 
doesn't  expose  his  going  beyond  the  court  order. 


And,  again.  I'll  stand  corrected  by  those  who  are  more  expert  in  the  way  tills  system  functions,  but  that’s 
how  I understand  it.  And  although,  yes,  that’s  the  law,  there  are  checks  and  balances  which  would  make  it 
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E2r',“,,‘ <ime  has  'X,,ire‘J'  wi,h0al  obj«io". «“  “-ill  have 


three 


my  question  that  you've^v^me  lmow°thitr  £^at  die -technological  part  of  the  response 

agencies,  JP-*^  WveWn 

hardly  anything  new  about  that.  ’ * * g be>  ond  the  scofe  of  the!r  responsibility.  There" 


to 

many 


OK,  it  s the  government.  And  that’s  what  I'm  not  sure. " 8 U *eS  e^  bod}'  beheve  that  it  r 


GRAHAM:  Will  the  gentleman  yield? 
CONYERS:  Of  course. 


a gentleman  raises  a valid  point,  but  I think  that  that  has  already  been  addressed  to 

LTo? e'pSs  So* t0  h3V?ihiS  Sy$tem  *****  by SdepSm  ° 

representatives  of  the'todependent  body^^^t^^ould  come^ere  to^h^r  1 W^imate^ 
that  we  might  have  of  them,  based  on  their  independent  Congress  and  answer  questions 


review. 


h%y/webJexk*nexl  $.cair^4r^ 
extremely  difficult  for  someone  to  violate  the  court  order. 

law  *»  "fa»p  law. 

prosecute  particularly  law enfoLment  *“  andwoukf 

tel  JtoSlre^ions. ^ ^ m *” the  COatext  ofthese  kMs  of  intercept s,  but  in  the  context  of 

CONYERS:  So  our  assurances  are  that,  first  of  all  there's  a law  loaino  it  «,n,vk 
prosecute  your  own  people  were  they  to  violate  if  and  that  there  are  other  technnlnoi<^U  ^ aSSlduo.us  y 
make  it  very  difficult  to  do  anyway.  There’s  a bJfiSSS^JSS  S &at 
information  than  you  want.  Is  that  the  way  I understand  that  ft cJSSS £S  g S 

Ihat  which  is  part  of  t”order doing  ti  p"**  *t°  col,fct.and  recorf 

and  with  an  appropriate  cEof cSy “geTSt"*  “ ‘ S'aW  by  the  ^ who  issMd  «d« 


'66477 
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CANADY:  Would  the  gentleman  yield  from  questioning? 

CONYERS:  Well,  yes. 

reyiewed  this  systeL  b?dyofexPerts 

could  change  at  any  time  after  that.  And  how  wood  you  maintain  * do;et  c®tera>  that 

Jllhnuted  after  they  had  investigated,  unless "» 


w1!:  II!if  3 Is:  c.hairman  C8152^  mere|y  *> 


it  began  to  take  on  a life  of  its  own  that  led  to  this  hearing 


about  it  in  the  scope  of  things,  and 


k£.!?T  anx*°?s  t0  bfar  the  non-government  witnesses  to  see  how  their  «nrff»rcfs,«ftinfI  „r  , 
been  happening  and  - with  this  system  comports  with  what  weVebeXS  what  has 

anyway;  that  s what  your  job  is  about,  that’s  what  you're  supposed  to  do  d‘ B*  1 thk  the  w,tnesses» 


Thank  you,  Mr.  Chairman. 


CANADY:  Thank  you,  Mr.  Con  vers. 


Hie  gentleman  from  Arkansas,  Mr.  Hutchins 
HUTCHINSON:  Thank  you,  Mr.  Chairman. 


son,  is  now  recognised  for  five  minutes* 


audit.  I think  cJ)des  t0  m independent  review  and 

purposes  of  reviewing  it  and  s^^aUt  Por 

Caniivore^Dr  Km?  ^ *** ,f  ^ *°  a!3owhlfi  °Pen  access  {0  the  source  code  that  make  up 

up  to  do  verification  and  vaHdat^^^  to  a group  set 

is>  off-the-shelf  software,  and  its 

under  the  license  that  we've  mid  for  °PCd  **’  We  re  not  at  hbert>' t0  divulge  their  source  code 


HUTCHINSON;  So  you  would  be  open,  though,  and  it  would 


ftof  compromise  legitimate  law 
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S£^2“4^#/toa* ”*  a °°eoi”® rcview  ,ysttm  of ‘he  source  coii's  for  o»x» 


ore  or  any 


^iew  it  ea<*  ttafvnn  SfST”  7C'd  tav'  “'  “*?e  P0”1  is.  you  know,  when  is  enough  enough’  Do  you 
"mml  S&TifcSr  ttMt  <te\wo**ie.  Do  you  do  i,  4«  ofT 
may  be  survaltace  beyond  amply  countutg  the  occasions  when  it's  in  «£?  net 

HUTCHINSON;  Tliank  you, 

NoWj  let  tne  — if  you  have  a content  court  order  to  use  the  CVrnivArA  evet/»m  # * 

show  probable  cause,  you’ve  got  to  get  vour  court  order  Rot  at  tw  ’ tfaeo*  f “ufse>  >'ou  have  to 

information  reviewed  by  Carnivore?  ' But  “ that  P°mt’ !S  inB0Cent  «-party 

KERR:  If  we  have,  in  feet,  gotten  proper  information  on  the  target  addresses  and  the  "tn  f ™m»  w , 

which  we  were  aSifeSo act^  recorded  something  to 

telephone  wiretap.  we  womanavt  to  minimize  that  just  as  we  would  on  a normal 


thSSS  f 1 [a,“? f r as  * piPe  “ whkh  Carnivore  looks 

mrougn  me  type  to  seize  that  which  is  the  subject  of  the  court  order. 


cs  at  all  the  data 


going 


KERR:  Right.  In  fact,  one  of  the... 


HUTCHINSON:  Is  that  pretty  much... 


KERR  ; Yes,  one  of  our,, 


HUTCHINSON:  The  question... 

KERR: ...  problems  is  that  the  pipes  are  too  big  for  us  to  do  that  and  we  relv  on  th*  . . , 

give  us  just  part  of  the  traffic  coming  through  their  big  pipe.  y h Serv,ce  ?rovjders  to 

HUTCHINSON:  And  Fve  learned  on  computers  that  sometimes  delete  does  not  mean  dew  th*t 
information  continues  to  be  stored.  And  so  my  question  is*  Is  the  info^Sn  i 

to  fee  court  order,  is  it  ever  retrievable  in  any  form  by  any  means''  * P *d  pUfSU£mt 


KERR:  No,  it's  not,  because  it’s  all  in  random 
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power  goes  off,  we  will  lose  everything  m that  memory.  None  of  it  gets  to  the... 
HUTCHINSON:  What  if  the  power  doesn't  go  off? 


KERR:  Well,  none  of  it  gets  to  a stable  recording  medium  like  magnetic  media  in  a hard  drive  or  a ZIP 
drive,  a floppy  disk.  Only  that  which  we're  authorized  and  which  the  filter  is  set  up  for  gets  to  that 
permanent  media. 


HUTCHINSON:  Now,  you  indicated  feat  year  to  date  Carnivore's  been  used  16  times,  I believe  20  times 
in  all  total  How  many  of  these  - of  course,  these  are  the  ones  feat's  used  the  Carnivore,  is  feat  correct? 
But  you  also,  in  addition  to  that,  use  court-ordered  wiretaps  or  pen  registers  to  retrieve  Internet 
information  by  using  ISP  capabilities. 


KERR:  In  some  of  the  cases,  we've,  in  fact,  been  able  to  ask  the  ISP  and  they  have  provided  us  the 
information* 


HUTCHINSON:  Pm  trying  to  get  a contrast.  The  16  that  you  mentioned,  were  these  not  by  using  ISP 
capabilities?  This  5s  when  the  FBI  went  in  and  used  the  Carnivore  system;  is  that  correct? 


KERR:  That's  correct. 


HUTCHINSON:  All  right.  So  I’m  trying  to  get  an  idea  how  many  others  are  out  there  that  were  used  by 
ISP  capabilities. 


KERR:  I don't  have  fee  number  with  me.  We  could  certainly  provide  feat  to  you. 


HUTCHINSON:  Does  anyone  know  that?  I mean.  I'm  trying  to  figure  out  if  we're  looking  at  100  others 
versus  16. 


PAINTER:  My  understanding  for  the  Title  HI  intercepts  is  that  it  is  not  a large  number.  Trap-and-trace,  it 
might  be  a little  larger.  We  can  try  to  obtain  those... 


(CROSSTALK) 


PAINTER: ...  Dr.  Ken's  indicated  — provide  it  to  the  committee. 


CANADY:  The  gentleman’s  time's  expired.  Die  gentleman  will  have  three  additional  minutes. 


HUTCHINSON:  Thank  you. 

1 mean,  it  just  strikes  me  that  -- 1 mean,  considering  the  number  of  Title  III  wiretaps  of  telephone 
communications,  I mean,  that’s  much  greater  than  the  16  or  what  you've  used  by  ISP.  And  I guess  what 
I'm  leading  to  is  feat  it  looks  like,  if  the  bad  guys  are  moving  as  the  whole  population  is  moving  to  data 
communications  through  fee  Internet,  looks  like  we’re  missing  a whole  lot  here,  that  we're  really  only  on 
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the  surface  of  what  we  might  need  to  b e doing. 


oft maUfc«SpiSCUS!i”8  “ "*  P°i"t  C“r"iVOr<!  has’ ta  f«- 


“molSow  J0i”!'"S  0Ut’  'h<?e's  a ,of ' olher  ,ra*c  0,1  Ibe  "«work-  We  continue  to  work 

to  try  to  see  how  we  could  develop  appropriate  and  lawful  tools  to  go  after  that  traffic  as  well 

It  would  tend  again  to  try  to  use  the  properties  of  fee  network  itself;  the  need  for  me  to  be  able  to  move 
GRAHAM:  Would  the  gentleman  yield? 


HUTCHINSON:  Yes,  fd  be  happy  to  yield. 


S^Sng^Hf mUtS' c-Ldlf  ^ ab0llt  if  il'S  not  e’maiL  W>“  "»K» 


E2SSf  use  other  protocols,  for  example,  to  move  large  files,  to  move  imagery,  to  move 
iarger  quantities  of  data.  And  A wouldn  t mo  ve  as  e-mail  m the  sense  that  weVe  been  Mkmo  /hrmt  k 

SS*  >'ou'.subiect."  whatever.  It  might  just  move  as  a block  of  data.  It 


01  m fact>  ^formation  that  companies  are  moving  from  one  location  to  another. 


HUTCHINSON;  Have  you  ever  had  a 
court  order? 


an  occasion  to  try  to  retrieve  any  of  that  information  pursuant  i 


fefo^:fl^hi«Vtr0t  hf1 any  $5**®?°  tbat  rm  aware  of  where  we’ve  tried  to  intercept  that  kind  of 
probably  be  pic t0  ^ * "*  S°mepkcC  8“d  We  would 

35^ 

* edM& 

But  this  is  still  a concern.  I guess  that  even  the  "to"  with  fee  address,  sometimes  a descriptive  term  ~ do 

“ hKVe  >-0li’ m fact’  fr°m  >'our  hlstory  of  the  16  instances  that  Carnivore’s  been  used  Syear 

^ h^i  m- 5 ? that  you  beHeved  y°«  needed  pLuW 

minimize!?  * ?yP  capture,  that  you  believed  might  go  into  fee  content  area  and  therefore  you  had  to 


CANADY:  The  gentleman  — the  gentleman.. 
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HUTCHINSON:  I’ll  just  finish  this  and  then  HI  be  done. 

CANADY:  Yes.  Hie  gentleman's  time  is  expired.  The  gentleman  will  have  one  additional 


minute. 


KERR:  I'll  reserve  the  opportunity  to  answer  carefully  after  review,  but  there  are  none  to  my  knowledge. 

HUTCHINSON:  So  in  other  words,  you're  saying  the  system's  working.  You're  not  caeturine  content 
information  beyond  that  which  is  intended  undefthe  court  order.  capturing  content 


minutes. 


KERR:  That's  correct. 


HUTCHINSON:  Thank  you,  gentlemen.  I yield  back. 

CANADY:  Thank  you,  Mr.  Hutchinson. 

The  gentleman  from  New  York,  Mr,  Nadier,  is  recognized  for  five 
NADLER:  Thank  you,  Mr,  Chairman. 


foehearkg.lf  ^ m question  that  may  be  rePe{isive  S!nce,  because  of  a plane  delay,  I arrived  late  i 

tnl  un<bsrstand  ll’  Carnivore  can  be  used  either  for  content  or  for,  in  effect,  a trap-and-trace  ins!  to 
know  who  an  e-mail  — who  a person  is  communicating  with;  is  that  true?  * ^ 

KERR;  Yes,  that's  correct 

NADLER:  So  it  can  be  used  for  cither  purpose? 

KERR:  Yes* 

NADLER:  Or  both. 

And  whether  it's  used  for  either  purpose  depends  on  the  nature  of  the  court  order 


KERR:  That's  also  correct. 


NADLER:  And  it  can  be  set  either ' 
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KJERR:  It  s,  in  fact,  set  specifically  to  meet  the  terms  of  the  court  order. 

“K^tag?^1  traP-“!|-,ra“  y°“  10  ta0"' «*»  *»«>*  is  talking  to; 

*'  ,rap-Md-,raCe  mi  “**• «« >»  »<■  from 

N5* no’ IS  d P3St  te®se?  You  get  a court  order,  we  want  to  know  who  this  guv  talked  to  in  the 

last  two  months  or  we  want  to  know  who  he's  talking  to  in  the  next  two  months? 

KERR:  It's  prospective. 


6fa477 


. lalkrng  to  and  sometimes  what’s  being  said  if  it's,  if  they’re  both  prospective? 
KERR;  I'll  let  ray  colleague  lead  with  that  one  please. 


vISS??SX:  ^ depeadv  ¥p?n  nature  of  the  information  that  you  have  available  to  you  at  the  time 

order  to  estahlkblhfn11^  SPoimat,on  at  tbe  time  $bat  y°u  se£k  the  pen-register  or  the  trap-  and-trace 
order  to  establish  the  probable  cause  necessary  to  seek  the  order  **  the  Title  01  order  for  the  < 


! content. 


Sp^and^ace?  ^°U  baVC  enou^ 10  ” you  need  a ^esser  standard  of  probable  cause  to  get ; 


n0t  S prj3k3b!e  caus®  standard  at  ali>  il*s  simply  a certification  to  the  court  by  the 
Seh  the  of!!£ ~nTd  he  2W  ef°/cement  3|enc>' that  the  information  that  will  be  obtamed 

crimlai  fovestigat  on  Pgf  3 the  {rap'and*lrace  ~ or  the  irap-and-trace  is  relevant  to  an  ongoing 


N ADLER:  With  no  probable  cause? 

DIGREOORY:  With  no  probable  cause, 

NADLER:  So  you  can  get  it  on  anybody  with  no  probable  cause? 


SSdlfS  EES  {fi0int  OUt  t0  you  Mim  ~ that  the  Supreme  Court  held,  in 

' s*  braith,  I believe,  ra  1 979,  that  there  was  no  reasonable  expectation  of  orivaev  in  numbers 

S0K-e°ne  tums  over  ^ formation  to  a third  party  like  the 
ave  e hef  a subjec{ive  or  411  obiective  reasonable  expectation  of 
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wifeout  any  probable  cause,  who  is  sending  me  mail  or  whom  I’m  sending  mail  to? 
DIGREGORY:  We  do  mail  covers  all  the  time,  which  essentially  do  that, 
NADLER;  Without  probable  cause? 


DIGREGORY:  That's  right, 

NADLER:  Thai's  very  interesting. 

Let  me  ask  you  a different  question. 

cofuSdSm T {hh&  %*.  Sadler?  The  authority  under  which 

® ^ ntted  States  Code,  I believe  tt  s 3 1 -25  (oh)  with  resnecf  ia  th*  r>^n  ... 


Ae/ti  . , auilluni>  unaer  wmcti  we  operate  is 
25  (ph)  with  respect  to  the  pen  - or  31-23  (ph). 


NADLER:  Thirty  -one-twenty,.. 


DIGREGORY:  Twenty-one  ~ 31-2 1 at  sect,  which  includes  23, 25, 1 believe. 

NADLER:  OK.  Now,  let  me  ask  you  a different  question.  You  installed  - vou  started 

Carnivore  system  about  two  years  ago.  and  no  one  ever  bothered  tdtmn  r u usa^b  “*,s. 

out  about  it  because  Earthlink  complained  about  it!  d * 8 C gress  afaout  lt;  we  Just  found 


^ .telling  Co?gress  ta  u»  sens.  of  all  of  Congrm.  There 
mcmoers  ana  staff  briefed  on  it  over  the  last  year.  It’s  been  widely... 


certainly  have 


NADLER:  Judiciary  Committee  staff? 


KERR:  Excuse  me? 


NADLER:  Judiciary  Committee  staff? 

SoSSS^ 

Department  of  Justice,  including  at  the  training  center  in  rnwEj  c J |?nefed  WltillQ 

a«on,c,s  and  AUSAs  8o  feeing.  &5S££ 
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° 1116  0ffice  ffEnforcement  Operations  in  the  Department  of  Justice  where  it's  m fact 
reviewed  pnorto  ever  going  to  a court  to  get  a court  order.  So  there’s  a very  substantial  level  of  rev,  ’ 


internal  to  the  FBL  mtemaito  the  deoartmenf  ZZluZli  T " a or  review 

order  is  issued  me  oepartment,  as  well  as  the  subsequent  review  of  the  court  before  an 


order  is  issued. 


N ADLER:  Subsequent  review  to  the  court?  I'm  sorry'. 


i think  I pked,  once  you  have  Carnivore  on-line,  what  institutional  safeguards  do  we  have  that 
misused?00  gathered  hy  Carnivorc»  presumably  afier  the  court  issues  an  order  to  install  it,  is  not 


CANADY:  Die  gentleman's  time  has  expired.  Die  gentleman  will  have  three  additional  minutes. 
NADLER:  Drank  you. 


ttat  '5at'  5“ic“!trt>'  “ a M|-  atom  intercept,  that  the  infonnalion  we 
iSlSlnwSfhe’orE  W SMl  ^ lhC  “m'  Whi£l’  C“  <ha.  weVe 


NADLER:  It's  provided  back  under  seal  to  the  court  ? 
KERR:  Correct. 


NADLER:  Is  there  a proceeding  in  the  court? 
KERR:  i don't  know. 


iook^aUt"  * me2n>  ^tbere  8 not  8 Proceed>nB  in  Ibe  court,  it'll  simply  be  placed  in  storage,  no  one  will 

PAINTER.  That  s not  completely  true,  because  it's  placed  under  seal  with  the  court  In  tb#*  T'lti.a  nt  , 
intercept  And  then  at  some  time  in  the  future,  the  court  can,  under  S nr  mX^hTt  ava^^^ 
instance,  the  person  whose  conversations  were  intercepted  and/or  his  defense  counsel.  ’ 


hSrcemedorS'm^r^?  r *f.#  ?ff\has  bef  the  subject  of  such  an  order  and  his  content  has  been 
imerceptea  or  simply  — or  simply  that  whoever  he  was  bw  tn  iL  „ rMr»  * 


* that  his  pri  vacy  was  so  violated? 


o^SteiSj»^r“^rViSir  f ri,h  ® - ifa  Title  111  «*r  is  fciied  bv  (he  judge 

«,w“  ^?!!!?L8rer  8 cuta.inPenod  oftLme  **  * believe  it's  90  days  - there  has  to  be  notice  to  the  people 


~ * tuuv  - Jt  uwiitvc  yv  Uet¥i>  mere  nES  to  h&  RAf  ap  t 

versatI0ns  were  intercepted.  I think  that's  been  done  very  broadly,  as  I understand  it. 
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S^LSv»Sj'oi B®  co"venatio»s  w«  i»<«epted  or  whose  — or  on  whose 


e-mail  there  was  a 


PAINTER:  Unto  rhe  provisions  of  Title  III,  when  you're  dealing  with  content,  yes,  that's  coned, 
^rf5a«o  Wh“  ab°U<  **“  yoa'a  not  dealto«  »*>  «”<«*.  «*'"  .volte  dealing  with  a 

^S:mp^aitacea?Mw?OTob,Hf  LSl,°“'d  et"Phasi.ze  |OtneUtfas  that  Mr,  DiQregory  said 

(CROSSTALK) 

don^anSg^wo™bU^uf  S “ Pr9taMP.  «“*  <°  <*«'ve  that  IVe  committed  a 

to  by  e-mail  or  for  that matter*’™  E5  £”  y0“  hav?  foll»wcl?  «*»  tm  talking 


privacy  was  violated  in  that  way?  Do  l ever  know  fbout IS  g <t°y°- ever  tell  me  that  my 

Hin  ! <*on,t  bebeve  tbat  tbere  55  any  requirement  for  disclosure  in  the  law  And  I would  nnJv 

Wthatr  priV3C>: was *****  and only  relyingi^jon  the  case  * " 
to  make  'Jb^S^SS^  *******  of  privacy  in  such  infortnalon  I just  wanted 

I IS  tSf 'PTe  fQUrt'S  P°int  ofview> th2t  here’s  no  reasonable 
rttioiri  th  , 01  pnvat>’ bu! 1 tbuiJv  as  a practical  matter,  most  people  would  be  somewhnf  mwt  ;c 


to  know,  Ithink  I should  know  StatThat And 3aS“,T ' di<ta'‘ w“  P“Pte 
basis  did  you  do  this?  Did  vou  have  mv mmn  t a ]!«  be ,ab  5 to t0  tbe  government,  On  what 

right  now,  there's  no  provision  forthS*  *°  d° it?  And  maybe  thc-v  did  and  maybe they  didn't.  But 

PAINTER:  Well,  that  they  *-  first  of  all,  the  prosecutor  has  to  certify  to  the  court  that  u ;*  -»!«»»  ♦ , 

NADLER:  What  period  is  it  limited  to? 

PAINTER: ...  is  60  days. 

NADLER:  Can  it  he  renewed? 
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PAINTER:  It  can  be  renewed,  but  it  has  to  go  back  to  court. 

NADLER:  How  often  can  it  be  renewed? 

PAINTER:  I'm  not  sure  there  is  a limitation. 

NADLER:  What's  the  longest  anyone  has  ever  been  subject  to  this? 
PAINTER:  We'd  have  to  look  into  that  to  be  sure. 

NADLER:  Has  anyone  ever  been  subject  for  more  than,  let's  say,  a year? 


PAINTER:  Again,  I don't  have  that  information  available  at  this 
NADLER:  Five  years?  Could  you  rule  that  out? 


point. 


If n do  alffl'S  T ,0  P1"  0S‘ ,he  ,0"8esl  «»»  «ta  anybody  las  eve 
J HM,  we  can  try  to  do  that.  I don  t know  if  we  have  those  records,  but  we  can  try  to  do  that. 


NADLER:  Thank  you,  Mr,  Chairman. 

CANADY : Thank  you. 

The  gentleman  from  Alabama  is  recognized  for  five  minutes. 


BACHUS:  Thank  you. 


Die  potential  for  abuse  here  is  tremendous.  Would  you  all  agree? 

PARKINSON:  Congressman,  I guess  I don't  agree  with  that, 

BACHUS:  All  right.  And  you  don't  have  to  give  an  explanation. 

PARKINSON:  Well,  I think  at  a certain  point  in  time  we  have  to  relv  nn 

who  are  - who  have  a number  of  cherk/3VTik„  ,1  - I y 013  the  Sood  With  of  pubhc  servants 
ne  nav  e a number  ot  checks  and  balances  m case  they  get  try  to  get  away  with  something. 

BACHUS:  1 think  you're  exactly  right.  I think  what  you’re  saying  is,  trust  us.  You  have  to  rely  on  us. 
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reij  m S-aymMn^^^vilaT&^CmSe  1 lhW!  ?°“'re  “aclly  ri*ht- 1 «**  you  have  to 
to  analyze  .11  the  phone  calls  that  come  ttaios^WyMetV  in°>“u?T&T  "d  **• ' Wre  «»*»* 

KERR;  That's  correct  We  can’t  do  that, 

BACHUS:  But  you  can  do  that  with  this  - with  Carnivore,  with.,. 

KERR:  No,  we,  in  fact,  specifically  don't  do  that.  We  only.,. 

through  that  Monnation^rMtMon?  you?  **  ” °f  >OU  d°  have  the  abi?lty  t0  anal>'ze  everything  coming 
KERR:  No.  We,  in  fact,  restrict  what  we... 

BACHUS:  Now,  you  restrict  it.  But  you  have  the  ability  to  monitor... 

Sfa&Slf1  ^ d°°‘t  ^ • mm  Wilh  the  10  *>  <•* «Mtae processing  of  that 

V 

system.  I mean!  ym  dSXha™ ^ whateveryou  want  on  thal 
KERR:  We  don't  have  the  right  nor  the  ability  to  just  go  fishing. 

BACHUS:  Well,  you  have  tire  ability  to  monitor  anything  within  that  information  stream. 

KERR:  No,  we,  in  fact,  have  the  lawful  opportunity  to... 

(CROSSTALK) 

BACHUS;  No,  I said  you  have  the  ability... 

KERR; ...  some  vety  specific  information.., 

haw  teLta’o"ogy  to  Si '5£ if  taVC  le8al  abili,y- B“  you 
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KERR:  We  are  not  sitting  looking  at  the  information  stream  and 
m place  with  a court  order.  It's  not  intended.. . 


moving  our  filter  around.  It’s,  in  fact,  put 


v™™£^Ut  Z?U  hnVe/2e  technoI°8y  to  go  in  and  monitor  every  one  of  those  e-mails  on  the  system  if 
there!  *1  °* N 3 °f  them  at  once* but  >'ou  couldJust  ~ you  could  monitor  here,  you  could  monitor  f 

KERR:  Certainly,  if  you  had  access  to  the  system,  in  principle,  you  could  do  that. 

BACHUS:  Which  you  do  — and  you  can’t  with  telephone  calls. 


you  “e  fa  ,he  tti'pht,"e  sys"m  and  »f» *w«ch 

BACKUS:  So,  you... 

wdUand  so  If  ton  thin8'  Remember>  ^ j»8  t elephone  switches  are  simply  computers 

weii,  and  so  u >ou  got  into  one,  you  presumably  could  see  a lot  of  traffic.  * 3 ‘ 

BACHUS:  OK. 

KERR:  The  fact  i$  that  there  are  a lot  of  bars  to  our  doing  that,  starting  with  the  law. 

BACHUS:  Safeguards.  They're  safeguards. 

KERR:  What? 

BACHUS:  They're  safeguards.  They’re  safeguards. 

KERR:  It's  tire  law.  It's  illegal  to  do  that 

BACHUS:  The  law.  OK.  I mean,  it's  the  law.  That’s  one  of  the  checks  and  balances  and  safeguards. 
KERR:  Correct. 

BACHUS:  Now,  one  of  those  was,  you  said,  the  Justice  Department.  You  have  to  go  to  the  Justice 

Department  for -and  notify  them  and  get  their  approval.  go  to  the  Justice 

S ^ tha‘  “ “k'S  * Weter  1<Ml  of  aulhori,i's  th«£  1»  approval  for  yoor  activities;  is  that 


you’re 
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KI2RR.  What  Mr,  Parkirisoii  was  saying  is  that  for  the  trap-and-  trace  and  pen-register  which  rmfv  *ti 

addressing  information,  ifs  a different  level  of  review  but  to  get  content  *vW  ^ht  ki  h y ®Uows 
be  demonstrated,..  w Dul  *°  content  w here  probable  cause  needs  to 

BACKUS:  V on  have  to  go  higher  up. 

™R:  its  ^ f3Ct‘ takeS  higWevcI  spproval  in  the  Justice  Department  before  we  are  ever  able  to  go  to  the 


BACHUS.  Well,  let  me  ask  you  this:  Why  did  Janet  Reno  not  know  about  this  although  it1 
three  years,  and  she  is,  in  fact,  the  attorney  general?  ’ al&ough  1{ 


s going  on  for 


KERR:  Well,  I would  remind  you  that  the  Department  of  Justice  is  some  127,000  people... 


BACHUS:  OK. 


KERR: ...  and  multiple  investigations. 


have!mS:  N°’ 1 thlnk  “ 1 tha,’S  a valid  poim‘ There  are  527,000  people  over  there,  and  we  might 

(CROSSTALK) 

DIGREGORY: ...  to  ensure  that  we're  balancing  privaej'  and  law  enforcement  needs  «nrt  t rutnt-  *u  ,< 
what’s  going  to  happen  with  respect  to  this  independent  nteds’  and  1 ihmk  {hst  s 

BACHUS:  So  she  didn’t  about  the... 

DIGREGORY: ...  verification  and  validation. 

CotSsSaS°stidbt?S  fh?v  °T  mf  ?sfadH that  **»  National  Security  Council  testified  before 
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SSw^folemem  ^T^&fart°f8m$  *"*«  from  timttojime*  share  information 

r«o,^!f  - niD  1 ,e  r?* U1  fact» some  very  important  hurdles  there,  including  the  Classified 

SSEf»  Protection  Act  and  others,  so  that,  in  fact,  the  primary  purpose  of  a system  may  have  been 

aboitfcr^  X lhat  p?aaty,  purp0Se’ u ma>' have  importanUnformation 

ut  a cnme,  either  committed  or  being  planned,  and  there  are  mechanisms  to  take  advantage  of  that. 

^ ge“lta“an’s  time  is  Without  objection,  the  gentleman  will  have  three  additional 


'*"*  m°ni"  " they  moni,or  3,1  «*.  at]  e-mails,  all 


PARKINSON;  I think  we  should  defer  to  the  National  Security  Agency  to  talk  oreciselv  about  bVh^ior,  i 
don't  think  we're  prepared  to  talk  about  it  today.  } precisei)  about  Echelon.  I 

BACHUS:  I guess  I would  just  ask  the  FBI.  They  do  share  - you  say  they  ~ when  he  said  thev  muting 
s ared  mformation  with  law  enforcement  agencies,  do  they  share  information  with  the  FBI?  * 

Wlhave’ as  y2u  Fobab3y  know>  a very  significant  national  security  responsibility  in 
Iaxy  enforcement  So  it  not  uncommon  at  all  for  foe  National  Security  Agency  to  selectively 

5ss Ts,"  * may  acquire- 801  ii  d»«  «•  - *•  K- pdAisrafgffis 


teSSial  SnCcnnSnl  Iff1  poiSl* M ,ite '?  us.e  ,te  « “y  r“>"l  qoeako.  and  .haft  - you  ay 

me  rsationat  security  Council.  I think  we  all  presume  they  re  dealing  with  national  security  Rut  <1-,--.;, 
gam  mformation  on  another  subject.  I mean,  if  it's  national  security, obviousNfoey  could ^ share  it  Stf  ^ 

Sme®  f itf  * S3y  ^ SUbjeCl  °r  lefsjust  Sa>’ that  we're  taring  about^X *£! it 


DIGREGORY:  Carnivore. 


vou^Sibif^*  tS?‘ K th.e  examples  y°u  8ave  us  were  about  espionage  or  terrorism  But  do 
j.ou  use  tlu^  sa>,  m antitrust  investigation?  Would  you  use  it  in  income  tax  evasion  cases'7  Can  it  he  »« 
m,  say,  OSHA  investigations,  or  EPA  violations?  Xie  there  any  restrictioS there?  ^ b $ 


Pti^yAct^  °fC°UrSe’ haVC  t0  be  a fedmI  felooy  to  come  «nder  Electronic  Communications 


BACHUS:  And  all  those  are ... 


2rritiesd  k W0UM  haVe  t0  be’ in  factj  one  of  tbe predicate  offenses  under  Title  III 


to  come  under  those 


So,  no,  it's  not  every  offense.  Clearly  Internet  fraud  would  be  an  appropriate  taroet  Chitrf  mranm,nw 
the  Internet  would  be  an  appropriate  target.  These  are  major  programs  vvifofo  the  FWfoft  wewSdd 
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(CROSSTALK) 


StoCs“oSs  Sf  0ther  **  e‘Tnai!’ can  yOU  set  *mo  files?  Can  yo»  " do  you  have  the  ability 


to  get 


oJhZ*?’  H®  * fff‘?tpJr?oco1  ~ ffle  '™fCT 

protocol  that's  “tog  SployS  °”ly  ®“  “ wha‘ "*  hav*  *'  addresses  <*  «>«”  the 

»m‘S!2bSy°U  ha'"!  *"“  a"d  <b'  pa$!words’  >-°u  “OM  “"»%  *et  into  maybe  a mainframe , 

S «^“&"Sr,hetolfc  ““  °rfCr  SayS'  'l'S  " * ",,,er  °f  S0!”8  aad  <»>»* 


WATT:  Will  the  gentleman  yield  for  a second? 

been  {ransmitted?  If  J«a  had  the  address,  would  you  - 

or  look  at  the  nnmkJ^  ? and  “ £hf  cfPfCIty  to  go  m and  either  look  at  the  content  of  a pnor  e-mail 
or  look  at  the  number  or  instances  m winch  there  has  been  communication  to  deliver  that  eiK 

CANADY:  7116  gentleman's  time  has  expired.  The  gentleman  will  have  one  additional  minute. 
BACHUS:  Thank  you. 


Let  me  - after  he  answers  it,  may  I have 


my  minute  then? 


KERR,  Shall  I try  to  answer  Mr.  Watt's  question? 

BACHUS:  Answer  his,  yes, 

Seadv  heen'Snf^n?''0**6  S{Stera  basical5>'  deals  with  message  traffic  on  the  fly.  If  the  messages  have 
already  been  sent  and  received,  another  way  we,  for  example,  might  get  it  would  be  if  for  7v  S«  « 

DIQREGORY;  And  under  certain  circumstances,  stored  communication c <h»f  s™  u»ia  , j 

communications  held  by  ISPs  can  be  obtained  by  simh  w ™ntTS  " 8,orcd  £-raa'1 
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BACHUS:  All  right.  Here’s  my  final  minute.  You  mentioned.,. 

CANADY:  Hie  gentleman  will  have  one  additional  minute, 

?!  Jk!.  rr;ent1i?ned  iudida5  oversight.  And,  Dr.  Keir,  you  mentioned  that  you've  got  the  defense 
attorney  arid  he  s looking  over  our  shoulders;  you  have  the  judge,  he’s  looking  over  our  shoulders  aTa 

fZTy  ictaix  has  abili,y  “>  hfmA 

f 

^lhffarf°a  y°% s?y  311  lbfse  03365  are  onSoing  criminal  cases  in  court  where  there 

is,  m tact,  a defense  attorney?  Or  could  it  be  - what  about  a case  of  an  investigation  where  fhlZ>cZV 
attorney  or  not  active  court  case?  investigation  wnere  them  s no 

KERR:  I tliinlc  Mr.  DiGregory  pointed... 

BACHUS:  Or  can  it  be  used  in  those  cases? 

2;^  Provisions  of  Title  HI  that  would  lead  to  judicial  notice  of  those  who  had  been 
intercepted.  They  certainly,  at  that  60-  or  90-dav  point,  having  been  informed  that  thplr 
^^rnmrcephsd  would  take  a great  interest,  Wh  W 

is  onented  very  well  to  protect  their  privacy  and  rights.  * me  s>  stem 

BACHUS.  Are  you  unable  to  take  information  you  gain  from  these  investigations  and  nass  them  nn  tn 
other  law  enforcement  agencies  about  unrelated  investigations?  Or  is  that  information  off  limhS 

?C  Sen?ifman'stime  has  expired.  The  gentleman's  had  more 
, naa  an3,one  eJse*  We  re  gorng  to  go  to  — we  have  a limited  amount  of  time  The  ntemhm  Aftu- 

Lwe?to?aw  his  £?“  qUeStl0n  about  other  thin%s  the  gentleman  might  want  to  ask,  but  Mr.  Barr's 
So  Mr.  Barr  Is  recognized, 

BARR:  Thank  you,  Mr.  Chairman. 

SfAllr^&Pite/aScinatks^ Th?  Cli?ton  administration  is  fascinating.  It  never  ceases  to  amaze  me. 
Committee,  we’ve  been  E*g  a series6  ofheari^  Srffabtof0011 


5/24/02  Release  - F 


fct^://%^Jexis-n^ 


tiwrelm  «S5fSS  S Title'xVTH  fn ! d<?  because  tbere  h a privacy  act  or  simply  because 

mere  are  sanctions  in  Title  XVffl  for  misuse  of  the  Title  III  provisions  does  not  guarantee  that  Lw! - 

this  or  any  other  administration  will  abuse  it.  So  I think  we  realiv  need  a little  bi?  more  than  simnt  Svin 
that  there  are  provisions  in  the  code.  " n re  inan  SW1W  saying 

hhdieshfL^Lrrinre’  f?1  prflems> but  lhe  fact  of  < the  matter  is  Carnivore  is  not 
a ^e  a basket  and  these  e-mails  just  sort  of  drop  into  it  It  is  vew  m^b 

oria  to  puU  « Jta  *! IS™**  'mbma“m  ” ,W ^ *£»  i» 

SS 

diffenS  te™!^!,h»  t&Vr  ,IV'anll-,“c'  ®d  r®  re8ia®  JO“'"  **>*  »hing  v«y 

ordel  Wanted  aniPfn  Stf* %vitb  phone  ^bers,  as  you  all  have  testified,  you  get  an 

from  a cfurt  , ^nSSt  d if 13  5y  !ower  than  a TltIe  m ««i  we  understand  that  ~ you  get  that 
trom  a court  - a court  has  to  grant  it,  there’s  no  discretion  for  the  court  - and  the  telenhon* 
it  were,  has  to  comply  with  it  Thev  can't  *av  ,i1P„  • , , ana  me  leiepnone  company,  as 

, * , “ / „ , u*  cant  sa}  --  tney  can  tiust,  you  know,  give  you  the  hloh-hnt  snA  «« 

W e re  not  going  to  do,  they  have  to  comply  with  it.  And  vn»  tot!  a™  JuJ  IL.  ® 5 5at.  . SAV> 


under  the  statute  to  do  that.  re  doing  something  ve^,  w^^^rcnt  h^e!38031156  ^ re^ubre<^ 

Wiat  you’re  doing  here  is,  you’re  going  to  that  ISP  provider,  which  stands  in  the  shoes  of  the  irsdit.v™! 
phone  company  when  you’re  looking  at  a traditional  hard  number  trap-and-trace  or  oen  reo  Jer  tnd 

mfonnSn8We  dS  sa.tlsfied ^hat  tbc  statuU  says  that  you  have  to  install  this  and  give  us^ihe 
SIS  • f yi*U- 1 dont  kno.w  why  y°u’  y°u  ^OW,  what  your  rationale  is  but  vou’re 

force iJolnow  g f d°  “*£*"  g-0mg  t0  §0  outside  of  the  Iaw  here,  basically,  and  weVe  going  to 
torce  you  to  allow  us  to  put  our  software  into  your  system.  You  will  not  be  able  to  monifnr  it  TVs  & *° 

siw  aUP/mm*iand  Utre  th£n  8°ing  t0  ta^e  i{  from  lhere-  ^nk  you  very  much  guys*  you  lust 

give  us  access  and  we  ll  do  our  thins  That's  v«v  ri;fW.nt  , J \ * *•««»«  guj s,  >ou  just 

work  under  the  teditionalCh^Ss  schme  h"  ***  {r8P’and-trace  «*  pen  registers 

Also  - 1 think  also,  there  is  new  legal  ground  that  you  all  are  Irvine  to  break  here  and  ,{ 

large  quantWea  of  infonJL  STpuSe?ooS  fZ^mt  ^ “ 8°  " 8"d' SOrt  0f'  harv«' 

I think  those  arc  two  very,  very  large  steps  that  we're  taking  here,  i don't  think  this  has  been  i j 

out.  And  thaf  s two  areas  that  I have  concent  about.  Why  is  it  not  ancient 

tesfimonv.  as  we  ac  % nnmW  „ 1 , ViriU  because  we  nave  both 


much  ~ in  A o ^ 2r  7 ZT  V\  y - * inm& imi  carnivore  does,  but  do  it  in  a 

a y *****  ls  mmh  more  Protective  ot  the  privacy  of  the  Internet  service  provider  users, 

s“S4SSa^  wre  no*  caPable  df  d™8  ”d  t *>"'  think  that's  the  case,  ten  you  could  reS 
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^Tiy  is  it,  m both  of  these  areas,  you're  trying  to  break  new  legal  ground? 

o£S  SL  te  tha‘ y0U  d0"'' ,Ute  ab0“(  ,he  “isti”s  Matott  *>>«  youta  willing  to 

r —*  — **« «« 

/ p C0U1£S  not  provide  the  formation,  and  Dr.  Kerr  can  talk  about  this  as  well, 
of  them  saying,  Weil,  we  have  to  comply  with  a court  order  Thfv  * ,J’ lt  "asat  Jus* s matter 

»<!  the  court  orferSL  'ha‘  W““Se'1 " *“  "‘ted  ^ K«  coon 

33A.RR:  And  that  was  not  the  Earthlink  case? 


PAINTER:  Again,  since  that  was 
service  provider... 


an  ongoing  criminal  case,  I don't  want  to  mention  who  the  Internet 


reported  in  the  newspaperf^  And* I !,^a?llIud£  cas£  because  ^at's  been 

case.  8reat  GarK  secref*  A»o  1 *»*  you  are  describing  the  Earthlink 

pnweel^  proceeding,  there  is  a court  order  in  that 

were  argued  at  the  hearing,  but  l don't  want  to  mSfe  **  pub!ic  facts  that 

BARR:  1 thought  you  said  at  the  beginning  it  wasn’t  the  Earthlink  case. 

PAINTER:  i did  not  say  that,  f said  1 don't  want  to...  . . ... , .. 

(CROSSTALK) 

BARR:  I think  it  is. 

PAINTER:  But  in  fact... 


'•3  of  76 


(LAUGHTER) 
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that  effect  tliat  was  presented  to  the  court  in  the  form  of  affida  vits... 

(CROSSTALK) 

BARR;  But  that’s  very  different  from  tire  testimony  that  we’ve  had  from  Earthlink. 

prff!S  « ,Vs  G**$*y the  policy,  as  I understand,  at  the  FBI  and  the 

fashion,  that’s  what  they^  prefer.  It  raise^thS  of  **  mform*tion  and  do  a <My 

SSf*" timC  baS  expired*  Without  °bjection,  the  gentleman  will  have  three 
BARR:  71}  auk  you. 


lf°}U  S7ing’  **?».  th,at  in  cvery  one  ofthe  25  cases  in  which  Carnivore  has  been  fuA  , 
that  it  has  been  used  is  the  Internet  service  nrm-ifW  w.  *„m  ort  nas  &een  USC<L  the  only  reason 

you  need?  2 P °X  sder  has>  to?d  > ou  the>'  cannot  provide  the  information  that 


PAINTER:  That  is  my  understanding,  and  I defer  to  Dr.  Kerr  to  also  address  that. 

provider  can,  f mfcmSn  to  fatf^et  servjcf 

,0nK  VMy  ,ar8e  teOTet  Provid"s  “ *«  fe  K hS.S„l«  SlIL 

by  bringing  in  our  Carnivore  system  and  employing  it  ? P ed  10  talce  the  technical  and  cost  nsk  away 

"Please  install  Carnivore"?  I don’t  think  so.  ’ J e ISPs  breaking  down  your  door  and  saying, 
as I undottufd  it,  Ital^oviSIStority1  for't beg<JS2Zw  a 

SfKR* * f™-  “d  "G«  - -eXg  yXtitSLou,  wha, 

mS^Zt s,™*  ^sr*  ^ chap,w  2m-  «*«•  « «■« 

exactly  what  you  want  and  that’s  all  that  you  get  § *“*  hea  fiter  11  out;  >'ou  teI!  somebody 


DIGREGORY:  In  the  case  to  which  - in  the  case  referred  to  by  Mr.  Painter 


we  successfully  relied  upon 


tef?<S 
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I the  pen-register  statute.  And  know  of  - and ! stand  corrected  if  someone  has  a correction  to  make  - and  I 

fjjk  Know  of  no  other  case  whers  an  ISP  has  challenged  our  reliance  on  that  statute, 

Sv 

5 BARR:  No,  but  is  - what  I'm  saying  is,  is  there  any  statute  or  case  law  other  than  this  one  case  that  as  I 
understand  it  is  stUi  m litigation? 

D1GREGORY:  And  I'm  saying  we've  relied  on  the  pen-register  statute  successfully  in  this  area... 

■j." 

(CROSSTALK) 

/ 

i BARR:  So  you  ~ the  Department  of  Justice... 

(CROSSTALK) 

D1GREGORY: ...  and  there  have  been  no  other  challenges  other  than  the  one  mentioned  by  Mr.  Painter. 

BARR:  The  Department  of  Justice  position  is  that  Chapter  206  provides  statutory',  therefore,  also 

^th0?ly’ 1 ^f88. you  would  ar8ue’ that  >'ou  had  ™ that  the  government  has  the  authority  - 
£ke  ££  togeS  iS2tfe”Se  Ca,eg0'5' otmtormatior1' far  tey™*  si">ply  «» >«8«,  and  then  itself 


CANADY:  The  gentleman's  time  has  expired.  Die  gentleman  will  have  one  additional 


minute. 


PAINTER:  I think  when  you  use  the  term  harvest,  you're  using  a term  that  really  doesn't  apply  here. 
2ow  and  ««  Ste  iS'KtU’8, " h 0nly  Cap,Urin8  int0m *i0a  lhat  yo“ 

55  rrder  1 mean> this  is  S0£t  of - that’s  what  I love  about  the  Clinton  administration,  then 
you  get  mto  this  circular  argument,  it  s almost  metaphysical.  You  have  to  have  some  wav  of  going  in 
there  and  finding  what  you're  looking  for,  otherwise  it's  a non-sequitur.  " 6 h 

“ /Jfa  8^v?«‘SS?M  aB“,cy  here>  ^ <0  answer  your  i***"  «irec,ly-  w* 

We  **? 1SP *°  brfn§  us  tbe  smallest  of  message  traffic  that  would  contain 

foe  target  messages.  We  then  brag  it  to  an  interface,  where,  in  fact,  a clone  of  that  reduced  set  is  made 
me  regular  message  traffic  goes  on,  unimpeded,  to  the  legitimate  recipients  of  it.  We  then  filter  the 
cloned  stream  ot  mformatton  and  the  packets  that  do  not  pass  our  filter,  because  we're  not  allowed  to 
record  them,  m fact,  vanish  at  that  point.  The  only  tiling  that  passes  our  filter  are  the  packets  with  the 
offfnes  addreSSUlg  mformati°o t0  meet  ^e  court  order.  And  I think  we’ve  demonstrated  that  a number 


In  fact,  we  appreciated  your  visit,  some  months  ago,  when  you  saw  it.  As  to. 
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(CROSSTALK) 


BARR:  When  I saw  what? 


you  were  at  Quamico,  some  of  the  demonstrations  we  ga 


gave  y ou,  were,  in  fact,  of  these 


to^iti^CarSvSr  2g°‘  ™ W*S  °S  CALEA‘ 11131  wasiike’  four « five  years  ago,  that  had  nothing 


KERR:  Well,. 


(CROSSTALK) 

BARR,  Well,  I hope  it  didn't,  because  it  wasn't  described  to  me  as  Carnivore, 

KERR;  Hadn't  been  named  yet*  perhaps*  — 

effect* tteSwJJto  onSf  ff3®'  P? -?8  th?,?8h  m ISP'  h fact- 10  do  H 

ul,w,= fa  fM' Eive " 

filiS  fiL“n“'  ” have  10  pr0vid' ,cctoical  assista"“  by  P“«fa«  our  V*m  fa  Ike  BP  in  order  to  do  that 
CANADA:  * gentleman's  additional  time  has  expired, 

yotJSSS.  Ma SSS^^S'” had  800d  p,esen“tions  in 

We  will  have- additional  questions,  as  I indicated  in  the  outset,  and  we  will  do  our  best  ^ ,w„ 

-eCdVe  th8  ^ will  S S the^S^A^^  Sk  yS  foryomtmG 

testimony  and  your  assistance  to  the  committee  in  this  oversight  responsibility,  ' 1 y r 

And  now  well  move  to  our  second  panel.  And  I would  ask  that,  as  peoole  are  exirinv  th*>  a„j 

of  th?  Stas  SSsecSd* °panefas  fhev  a ^ ^ bfC3Use/m  8tmg  t0  Prowed  the  introduction 

incomers  m me  second  panel  as  they  are  coming  forward  to  take  their  seats. 

mnceS  fnreLT  thlS  sec0”d  and  fmal  Panel  of  tody's  hearing  will  discuss  privacy  concerns  and 
concerns  for  network  security  rai  sed  by  the  use  of  Carni  vore.  y concerns  ana 
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American  C^fuberti«PUn1om1?I  ^ Sleinhardt  Mr-  Steinhardt  is  the  associate  director 


: of  the 


^tSIoiogy. WC  WlH  hCar  &°m  Mm  Davidson>  wh0  is  the  staff  counsel  for  the  Center  for  Democrat 


Following  Mr.  Davidson,  will  be  Tom  Ferrine  Mr  Perrins  i<c  » ■ 

Institute  for  Computer  Security.  He  is  aIs^™aV^i?J^  fPn  Te*Stl¥0r/or  the  ^ific 
Computer  Center.  y We  macager  of  «*unty  technologies  for  the  San  Diego  Sup, 


er 


th ?? ^endmeem, aIjf HartS0,V sP^taHzing 
tilts  subject  previously  * Mo SSSSSSlS^ 


Stewart  Baker,  an  attorney  at  Steptoe  and  Johnson  will  then  testis  Mr  n-t. 

telecommunications  equipment  mamiftrfnrpj-c  «„,i  . tesIJ  v * Mr,  Baker  represents  major 

Assistance  for  Law  Enforcement  Act  and  law  enfnrrpm  et?  in.connectlcm  with  the  Communications 

gcncmlcotmsclofthcNaX:^ 


Finally,  \\s  '*dll  hear  ffom  Peter  William  Sachs  Mr  Sachs  owns  tmxrw  i it 
provider  based  in  New  Haven,  Connecticut  IC0NN’  LLC’ 


a small  Internet  service 


W ; rs*-*  ,ta  «*  «*»  * o your 

statements  will  be  made',  par, 

So  we  will  now  turn  to  our  first  witness  of  this  panel,  Mr.  Steinhardt. 

STEINHARDT;  Thank  you,  Mr.  Chairman.  . - 

LPi“oSi^1lLySSStag.,,,e  0p|,0mmity  10  *«*  h“  M ate  want  to  thank  yon  for  so 

bears  a great  ilofiSj  wresOTThty  Utm  e^iSjaSIStow'fo™”'  “”d  “ ,ha' 

hS'top  of  doraS  Carf°re  « onprecedented  in  the 

whtch  accesses  all  the  comntunSSS^f  a £2L hw  installed  a device 

communications  of  the  target  of  a «SSSiS2? £ ur  cu®tomfs>  ra*er  than  only  the 

that  it  sliould  be  granted  access  to  0I?eT\  ^ever  before  has  a law  enforcement  agency  claimed 

granted  access  to  all  communications  passing  through  a service  provides  netJoSased 


*of?£ 
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d °"  m unsupcrvised  promise  that  it  will  not  stray  beyond  the  confines  of  its  authority. 

t Carnivore  is  roughly  equivalent  -as  a number  of  the  members  have  U’m^ui  ■ , 

a wiretap,  capable  of  accessing  the  conversations  of  all  the  phone  comnJw’s  cntowS  equn'f!em  t0 

' Tf  0ffekr?ibefore* when  ^ suggested  that  the  to  and  froiSh tScSh^Snt, 

the  key  to  look  for  which  messages  to  record  the  »n*Wv  „f . rt.il  - "v  c Var,mvor®  box  uses  as 

post  office  and  stationing  an  FBI  agent  there’  looirin  « * ’I  e?U!va!ent  of  going  to  a 

goes  through  and  then  picking  out  LsevdSh  h wkhS  t reSS!  ™[0TIf'im  Pf  eve2?  ktt^  that 
open  up  and  actually  look  at  the  content,  shes  to  record  either  the  addressing  information  or  to 

Now  I must  $ay?  I want  to  comment  oh  one  thing  in  this  section  *-  on**  thmc*  tu#*  i j * 

earher  this  morning,  and  that's  this  audit  trail  that  forthe  first time aC^hifilf  Su 

M^Smtly  we  are  t0,d  records  at  Ieast  what  the  «**«£ EJ  VS2£, ofk^tffif 1 ** 

I think  there  are  probably  a number  of  things  that  are  worth  noting  about  this  audit  trait  *w 

apparently  was  created  only  recently,  and  I would  this  . 


use  in  a yeiy  limited  number  of  cases,  that  <* 

Wb0  “ *oto* 

oi  the  order,  not  someone  who's  being  prosecuted?  P*  an  innocent  third  party,  not  the  subject 


ttaUtMnkftlt  ‘‘™''  f “PP0"™''!'  in  which  to  contest 

carefully  at  all  those  toails  tht  „ud,t  tool  suggests  ,s  that  you  need  to  look  vny,  very 

t0  imagine  how  the  operation  of  Carnivore  can  be  scuared  eithw  «.ritn  *+,  , tr  , , 

ECPA,  which  was  adopted  to  implement  the  Fourth  Amendmt^ 

the  intmsion  into  Se^ri^c^of^  noSelS^  tarSetedso  as  to  avoid 

not  have  reasonable  cause  to  betfeve  that  they  are  engafed  in  a cS  f Wh°m  8W  enforcement  do«s 

!nJ^?£!,t!0n  °f thts>  E9PA  requires  the  government  to  specific  the  person  who's  the  target  nf  the 
ui\  estigation*  ensues  under  investigation  the  oarticular  9* 

accessed.  They  place  on  the  provider  of  ihe  co^unicafions  mLi^  2 ? he  C?knHnunication  15 10  be 
tho  communications  of  pontons  authorized  to  be  teereepS  fem! X?SS££ T °“ 

Carnivore  is  in  fact  a nJ5miiS?o!  touS SSSST  as  ?«"  “egeMed. 
enrite  steam  of  communications  that  is  teveltag  S£“*  *° ,he 
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J«*yAw*Ue^^  : 


HS 

Carnivore?  What kite smtute ' ^ai"m ECPA^wiSIn ^ nw'r^-t,'5  *e s!atuE?ry authorisation  for 

q “sta  tSd chi  Mt™"'  *“/!""*»  taattH  CMtere?  iSSSS^S^SSST 

Sts1 5SfcSrstf '&R3g  sKz  sr  t,  ,“v ,bou*  «teSte&s 

never  went  higher  ten  one  federal  magistrate.  “ *“  we  talow  V“V llttle  about  «nd  that 

%,t 

jsai— 

m < bald crSaTSS'te ofSroll : thte^S'need to Stt^SS^SteifBSB  ff?,8' 

mat  - the  recent  history  tells  us  that  the  FRI  ram**  k*  * j,  recent  mstoty  ot  the  FBI,  which  tells  us 

claim  tet  Carnivore  is  a permissible  1£*  - L re?v SStfStfKS 3E^5ffi&  * 

Let  me  give  you  --  let  me  give  you  some  examples. 

£t3S£&r  »S±bS±& 

enforcement.  ,^oZS,Z ^ 
providers  to  provide  it  with  new  sorvcillante  capaWiKS^S toSE 

f ?"s.?5‘ ,ly  ““^Ji  greater  capacity  and  new  surveillance  features  SL  Ito  M 1 t oJfS’ *!  ™h?.s 


fcLTSKSf amPle  °f ' “*■  °ttes  “ to  ray  <«*»»>’•  B«  I “> “ » example  is  worth 
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2^.^^  il  ”«  “«  — law  ,0  s«fc 

S™*11®!"'  "1th  refcrace“>  this 
be  called  tracking  information/'  p orroats°n  “ t0  inquire  anything  that  could  properly 

Well,  whether  or  not  that  was  Director  Freeh'c  inf,w»fm«  i on/  v . , , , „. 

1995.  And  the  FBI  has  fought  tooth  and  nail  i \ became  the  m's  policy  in 

before  &6  Federal  Communications  Commission  and  now  in  th^in^r^006 L®dustry.  then  with  ~ 

* CoI°wbia,  fought  tooth  and  nail  for  (he  proposition  that  CjSea  H'S  ??*  of  A?Pea3f  for  <1»  District  of 
operators  to  provide  It  with  location  tracking dntoatiom  f ’ d°eS  reqmre  the  cellular 

hear  krimonlTShf yoaVe.  fioin« £o 

suggestions  of  the  witnesses  that  you  - that  you  heard  earlier  wP  yC£  no!to  s,mPty  trust  on  faith  the 
service  providers  cannot  provide  £n  faftSS^  *’  *“  ***“  haVe  bee»  «**  that  other 

know Eh? b°X  VV°rks>"  0r in  !his case,  "We 

St’  w te0W  *“***«  about  fn  detailed  n«^*2hhiS!!?,1^to  * blaCk  box"  7112 

seal,  because  these  eases  all  come  up  ex  parte  - these  request  fi^ord^ 

not  prepared  to  ask  you  to  doSSh  ^^*fneSSe“  &°m  *he  80vemment  were 

explain  to  all  cat1  c^!ude,  because  - let  me  just 

the  importance  of  this  in  any  way,  but  wedo  have  aE£  That’s  not  minimizing 

which  we  are  moving  to  after  this.  h g 0n  a P™?08*1  that  Mr.  Frank  has  introduced 


the  palr^  **  y°U  CSn  reaIly  Sta*  clo$e  to  «*  «™  minutes,  it  would  be  beneficial,  giv, 


gi  ven  the  size  of 


FRANK:  Mr.  Chairman? 


CANADY:  Yes? 


FRANK:  Is  it  the  intention  of  the  chair  to  adjourn  this  hearing  and  go 


to  the  next  one  at  4? 
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tei* hSg”  °f  th'  Cll*ir  ‘°  h“r  the  Witaesses  “d  10  have  °"e  rou"d  of  questions,  and  J 


FRANK:  Thank  you. 

STEINHARDT:  Well,  HI  stop  there,  and  allow  the  rest  of  the  panel  to  speak,  then. 

CANADY:  Thartk  you*  Mr*  SteinhardL 
/ 

Mr.  Davidson? 

Va.4/an  Cavidson, w&h  ^*e  Center  for  Democracy  and  Technology.  Fd  like  to  thank 
the  Fourth  °f 


hrmrW  A,  iV  — wv. . otv  puoicmaue;  ana,  second,  oecause  Carnivore  raises 

!™Sfu"  the  need  tor  greater  privacy  protections  in  our  increasingly  outdated  statutory  and 
constitutional  framework  that  governs  our  surveillance  and  privacy  laws.  statutory  and 

K ?wl^?  * -C  firSllthe  ^estiotvs  about  Carnivore.  I think  the  threshold  question  for  Carnivore  is 
, , Cams  ore  has  access  to  much  more  iniormation  than  ti  is  legally  entitled  to  collect  Hnw  rin 

we  taw  >ta«  wo  oa  .ms.  Carnivore?  How  do  we  taw  wta.  kind  of  SSKSTjS  « SrS$ 

SkS  eo“fe's  “«ence>  tD’  to  give  the  committee  a sense  of  a little  bit  of  what  we’re 

talking  about  with  packets,  here.  I’ve  got  a couple  of  slides  that  I’d  like  to  put  up  quickly. 

rfSnYkiwfw  3 couP]e  of  disclaimers.  These  are  captures  of  actual  real  packets.  And  for  those  who 
do  1 hrmg  their  opera  glasses*  these  are  actually  should  be  in  your  nacket^  TWvV**  th&  ^ r n 
to  a“<hence  - they’re  the  last  three  pages  of  my  testimony,  ' P 'Y  re  the  “ and  for  folks 

SaS  ref ! PlcketS  ?at  have  bf:i  captured  from  CDTs  network  with  a very  crude  tool  : 

tl£  7 look  ^tog  like  what  Carnivore  looks  like,  but  I thought  it’d  be  faeioftdfor 

hardSSdo  som!  of  ffllhln  2*X  f^hat  *om«  of  the  things  that  we’re  talking  about  look  Ifltemid  how 
Carnivore.  °f  th  ^ 1,8  {bat  Carnivore  says  it  s doing,  and  how  hard  it  Is,  maybe,  to  trust 


SJ,’ rth\  th‘S  fKSt  packet  is  3 sampJe  e'  toatl  message  - actually  a real  e-mail 
“ off  of  oot  nSrk  y ’ SUbCOmmmCe  COUnse]’ 0R  Frida>'  was  captured  off  of  our  web  site 

ScSthafSS hi,”  f h I5  ^hai  a?!cket  mWsr  do®s  to  a P3cket.  It,  kind  of,  breaks  it  up  into  different 
pieces  that  can  be  understood.  And  there  are,  sort  of,  really  — sort  of  two  chunks  to  ttiic  mforrr.atirtT, 

^ t0/AWhiChr  i0t  fpeopl?cali  tbe  ^ader  information,  wliich  contains  a Im  of 
me  aaoressmg  information  and  description  of  the  packet.  The  second  half  of  it  k wh-*t  T oati  o,* 
or  <hc  payload  of  th*  pacta.  Aod  WLcMcs  IheV  *0 xtS  tf 


i of  76 


5/24/02  Release  - Fag*  95 


«/o.nn  i>t7Pi 


L£X!£<8>-NEX!S® 


■nexiwoin^.^..  JS^bcf305a4S  1 7927SfSfae?2fi»  m All 


topics,  or  political  topics,  or  social  topics,  and  all  of  this  gets  listed  fa  this  pen 


register  for  the  Internet. 


~ ""7* *"uw*  5uiB6  o i mes e tames*  these  tw  «,»w  _ A Ky  : <r  * M «**=  10  in*f  to 

came  up  with  m the  old  context,  the  telephone  conS  %r  exanmie  S ffe  re§^  we 
something  - was  something  that  wasn’t  as  sensitive^ 23!'  r that  dlg,ts  diaied  were 

extremely  low  standard  for  access.  * d e’ 1 thmk>  Congress  to  create  this 


$s$& 


probable  cause  standard  in  die  pen-renter  coSS  rcaSonable  “ 1 meari  a ^levant  standard  and  a 

about  how  it’s  being  sSoSeto^  w°2e^on?emed  Mf Coricems 

be  opened  up  for  the  world  to  see.  There  needs  to  h«  vlt If  fd  ab,out  the  that  it  needs  to 

know  exactly  which  pieces  of  the  packet  Carnivore  is  locking  aTm^Sdltoglts  ?** we 

people  Who 'ire to te^posSnSo'tUs  balmctog S'”1  “ thC hal,*  of ,h' Isp-  The  ISPs  are  the 

» ' 

And,  finally,  1 thuik  all  of  this  points  to  the  need  fbr  + * - 

i4r«x“xT)S 

The  White  House  has  taken  a good  first  step  We’re  looking  fnm.,a_j  * , . 

step  doesn't  quite  go  far  enough,  but  we  really  want  to  work  wS  ftJi!  worfcmg  w,th  everybody.  That 

protections  here.  0 ' mi  10  vv  orK  w,th  tolks  to  try-  and  improve  the  privacy 

Thank  you  very  much  for  your  indulgence. 

CANADY:  Thank  you,  Mr.  Davidson. 

Mr.  Perrine? 


subject  of  Carnivore  and  5'0U  for  me  t0  test£fy  013  £h<3 

trfnSSfnor  °'!  C0ri0n?  toown  as  Carnivore  is  really  about  thSs  ^SemntL^i  F®rs,new 
translate  the  potass,  law  and  pntcOces  of  telephone  wtetaps  ,o  the dfgSl  ralm“ y 

Today  s testimony  has  shown  over  and  over  again  that  there  are  that  ,5,„ 
old  law,  as  applied  to  the  Internet,  may  be  leading  to problems  “ **"“  d,ffia 


'nag  interpretations  of 
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privacy  of  citizens  may  be  eroded  in  ways  not  intended  or  permitted  under  current  wiretap  laws. 


to  SSSS32 1 * ty* fVe  aways  ¥en  an  advocate  of  personal  privacy,  unrestricted  access 
Dm  toll Sa?the  4 Sr  ff*T aod  ^entimi  in  the  ifci/taSSSSfSto? 
to  kteStafR?  w!  ?KC  P«  ?r,  Cenie.r>  1 a!so  understand  the  need  of  law  enforcement  to  be  Sle 
to  intercept  traffic.  We  spend  an  awful  lot  of  ttme  detecting,  analyzing  and  tracing  compute  itmsions 


But  this  is  about  balance.  Hie  needs  of  law  enforcement  and 
can  be  a balance  between  them. 


privacy  are  not  mutually  exclusive.  There 


SpaSroTreSrime  infra/truucture  ~ ^d  someone  did  use  the  word  Echelon  - 


.ha,  KK1- ssj  sr^ ati  t inffic’ Wk « 


by  a human  being  or  ifS£  ““  “ ,nUy  ““  ,he  *“*  ««■ 

taSdK? IbJ^  °f<he-0“  ,'lf^Mic  sy«m  tat»  «*  - 

numbers  used.  And  weVe  also  heard  testimon^thM  Lf^S.fc^^emiralmuo'Se  £'Pd°l' 
e-mail  addresses.  Are  they  the  same?  Actually,  I think  not  ^ equivalent  to  the  to  and  from 

r«t5{^lVOr*t»1$-}U^ia  tooi  811(1  its  capabilities  must  be  considered  in  the  context  of  how  if  m»H  „c^ 

network  that  it  monito5^CTe?nothkg  t?sto^^  through  the 

to  monitor  alt  the  network  E.  C?rwvor*  ^?1«%  ~ using  Carnivore 


*&£*££  SSSSSKSZf  ?e  ^ fa  ' skem  atSk^at 

installation  and  the  filters  during  the  monitoring  process.  **  Source  code  ofthe  §ystem 

a“to°^SLr  eMmim  0f  ,he  C0“e  code  °f  the  Car”lv“re  **»  «*  <h«ir 
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vemication  validation  organization,  would  provide  only  a snapshot  of  Carnivore's  capabilities  with  n. 
?SwT  CarBiV°re  pr0gram  actuaI1y  **■»*  « » ISP  was  built  from^S^ourcmh^was 


no 


5afrnij°fe  u^er  constai5t  development,  so  the  source  code  snapshot  that  was  reviewed  would  be 

Imnwibf VY '7  pklIn*n$  ob  as  ongoing  independen^erijicat^ 

\anoatioq  process,  you  il  never  know  that  what  was  installed  was  actually  what  was  reviewed  And  there 

is  no  source  code  review  that  would  indicate  the  filters  that  were  installed  in  Carnivore  at  a given  ISP  on 


a given  case. 


a *T — ********  nuwu  «^hcu  tu  uic  wwnrci,  ana  i mmK  we've  seen  that  todav 

And  applying  these  old  laws,  may  unintentionally  erode  constitutional  protections  in  unintended  ways 


Law  enforcement  may  need  appropriate  legal  access  to  internet  communications  under  limited 
SSSig8  ”us,  be  profKd5' conttoik<1  “<*  to  ensure  that  constitutional.. 


Thank  you. 


CANADY:  Thank  vou. 


Mr.  Com-Revere? 


^2“^  “d  n,“bm °f ' *'  «“*  y»"  f” inviting  me  back  to 


W “b?“«>°n  in  five  minutes  or  so.  111  dispense  with  that  and  just 

vStaessefni  2bfU  Carnivore  that  were  discussed  in  the  testimony  of  the  government 

SSiSffl  °n  *wo  °r  tee  pomts  related  ,0  » «V  experience,"was  CanS? 


One  of  the  first  points  tliat  was  made  is  that  Caraivore  is  used  in  only  very  limited  wavs*  that  it's  used 
only  when  an  Internet  service  provider  either  cannot  or  will  not  comply  ^SrtSSr. 

Pamter  tes^fie^ that  & &e  one  challenge  that  he's  aware  of,  that  incoming  e-mail  addresses 

the  instalklo!fl/^ai  * ^ T*1*  rec^ve^>^a{  then  required  tlie  government  to  move  forward  with 

the  installation  of  Carnivore.  That  s not  quite  what  happened  in  that  case. 

“ whtch  f was  involved,  the  ISP  did  try  to  comply  with  a lawful  court  order,  the  pen-register 

FWtmn^  r'traCe  °rder- 11  ls?mply  taken  as  a §iverl»  the  ^SPs  are  obligated,  under  the  term/of  th? 

Pnvacy  Act,  to  comply  with  lawful  orders  of  the  - lawful  court  orders  to 
P e in  formation,  but  at  the  same  time,  they're  required  to  protect  the  privacy  of  their  subscribers 
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£n  thiscase,  the  solution  that  the  ISP  put  in  place  did  get  all  of  the  outgoing  — excuse  me  — all  of  the 
incoming  e-mail  addresses,  and  it  did  supply  a smaller  number  of  outgoing  e-mail  addresses  to  the 
government.  They  were  dissatisfied  with  that,  saying  there  must  have  been  more  outcome  e-mail 
addresses.  w * 

In  fact,  we  tried  to  explain,  that  they're  any  number  of  reasons  why  there  may  be  fewer  outgoing  e-mails 
then  there  were  incoming  e-  mails.  For  example,  the  target  of  the  investigation  might  have  used  a 
web-based  e-mail  source,  rather  than  using  his  own  resident  program.  But  nonetheless,  the  U.S.  marshals 
were  dissatisfied  with  that  solution  and  informed  the  ISP  that  they  were  coming  to  install  Carnivore 
ivithin  two  days.  That's  what  prompted  the  court  action  that  led  to  the  magistrate's  order. 

I believe,  Mr.  Painter  then  testified  that,  since  that  time  the  ISP  has  provided  excellent  cooperation. 

In  fact,  the  ISP  has  done  in  subsequent  cases  what  it  did  in  that  case.  It  provided  and  offered  to  provide 
ways  to  comply  with  orders  that  it  received  in  ways  short  of  installing  Carnivore,  and  since  that  time 
Carnivore  has  not  been  reinstalled  on  its  system. 

Secondly,  in  response  to  a question  from  the  chairman,  one  of  the  government  witnesses  suggested  that  it 
was  the  ISP  and  its  implementation  and  not  the  Carnivore  program  itself  that  caused  a crashand 
disrupted  the  ISP’s  system. 

In  fact,  our  experience  was  that  Carnivore  was  incompatible  with  this  system,  requiring  the  ISP  to  make 
adjustments  w'Mch  led  to  a number  of  problems,  that  ultimately  led  to  Carnivore  being  taken  out  and 
then  the  next  day  the  order  for  its  installation  expiring. 

Let  me  say  just  one  other  thing  about  that  order.  In  fact,  there  was  a magistrate’s  order,  still  under  seal 
that  did  require  the  installation  of  Carnivore, 


CORN-l^VERE:  ^.^ed  to  work  out  in  the  terms  of  that  order  what  safeguards  we  could  to  make  sure 
that  no  more  Mormatton  could  be  collected  than  necessary’.  But,  in  fact,  what  the  magistrate  said  in  that 
order  was  mat  he  would  welcome  the  decision  on  the  legality  of  Carnivore  under  the” existing  legal 
scheme  to  he  decided  by  a reviewing  court.  We  haven't  had  that  kind  of  legal  review  yet,  andl  don't  know 
of  a case  m which  that  may  occur.  - A 

Next,  the  government  witness  talked  about  the  number  of  safeguards  that  exist  to  make  sure  that 
Carnivore  does  not  lead  to  excessive  violations  of  subscriber  privacy.  For  example,  Dr.  Kerr  testified 
that  the  filter  will  ensure  that  Carnivore  acquires  only  the  information  that  is  authorized  by  a court  order 
and  suggested  that  it  would  be  necessary  to  obtain  the  assistance  of  a technician  or  even  perhaps  the 

SS?t0fthei ISP  t0  aitef.the programming  of  Carnivore  so  that  a rogue  agent  might  gain  information 
to  which  he  or  she  is  not  entitled. 


Pm  not  a technician,  so  I can't  really  address  that  point,  but  I can  say  that  in  the  case  that  I was  involved 


. ufcurauwi  varmvere  couia  oe  Changed  with  the  flip  of  a switch.  Maybe  that's  correct,  maybe  it’s 

incorrect,  1 don  t know.  It  does  suggest,  perhaps,  that  the  proposals  that  have  been  discussed  earlier  for 
independent  review  of  Carnivore  really  are  in  order. 
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mS«V?W  J?f  #? *Vue  Wl15  be  pr<?tected  from  invasions  of  privacy  because  there  is  an  audit  trail  that 
makes  sure  that  the  filter  is  correctly  set  to  correspond  to  what  is  authorized  by  the  court  order  and  that 
that  will  be  available  with  the  evidence  in  a prosecution.  But  in  fact  that’s  a safeguard  that  exists  only  if 

Ttere  is  no  requirement  to  notify  the  target  of  a surveillance  in  a trap-and-trace  situation  that  that 
surveillance  took  place.  So  if there’s  no  way  to  ensure  accountability  in  that  circumstances^ 

t 

As  I had  mentioned  in  my  April  6 testimony,  surveillance  was  undertaken  briefly  with  Carnivore 

top^and-trace  authorization,  which,  as  many  people  have  noted  here  today,  is  available  only 
[elevance  **  certification  of  relevance  by  a law  enforcement  authority;  there  is  no 
requirement  of  probable  cause  necessary.  J 

\*£ie«Zh  S' mTr BSChUS  asked  whether  °f  I30,{  Carnivore  has  been  used  for  violations  of  any  other 
laws,  such  as  antitrust  laws  or  consumer  protection  laws  or  anything  else.  The  response  was  given  that 
Carnivore  can  only  be  used  m the  event  that  there  are  specified  federal  felonies  as  set  out  in  Title  ffl. 

As  a marier  of  fact,  that’s  hue  only  tor  Title  HI  intercept  orders.  You're  not  required  - or  you're  not 
limited  m the  use  ol  Carnivore,  in  the  event  that  it's  being  implemented  in  response  to  a trap-and-trace 
or  er*  ^ei0Ilies  are  sPeaTied  ***  Title  1JL  All  that  has  to  be  shown  is  a certification  that  the 
prosecutor  or  the  law  enforcement  agent  involved  believes  that  the  use  of  Carnivore  would  be  relevant 
and  the  information  gained  would  be  relevant  to  an  ongoing  criminal  investigation. 

if  r*?iii*?V!  f°  sayis  ^^ily  just  paraphrasing  what  I’ve  written  down  and  that's  already 
submitted.  And  1 11  just  leave  it  at  that  and  be  happy  to  answer  your  questions  later. 

CANADY:  Thank  you,  Mr.  Com-Revere. 


Mr.  Blaze? 


BLAZE:  Thank  you,  Mr.  Chairman. 

°tUt  that  mY  co?fents  bere  dofl  necessarily  represent  the  viewpoint  of  my  employer  I’m 
here,  so  to  speak,  on  my  lunch  hour  to  provide  the  scientific  and  technical  perspective.  v y 

My  interest  in  the  problem  of  intercepting  traffic  on  the  Internet  for  analysis  dates  back  to  rav  doctoral 

d2coVSdthenULnd  3ST tc tnrtBc  that  I would  analyze  as  part  of  my  dissertation  vvork.  What  I 
discovered  then,  and  what  s certainly  become  even  more  the  case  as  we've  gone  to  higher  speed  and  more 

«etw>dcs  with  more  protocols  running  on  top  of  them,  is  that  die  problem  of  collecting 
data  from  Internet  packets,  from  the  packet  level,  is  a very  subtle  and  difficult  one. 


BLAZE.  So  my  comments  today  address  the  question  not  of  how  do  we  ensure  against  the  mwdbiiitv  of 
malice  or  misdeeds  on  the  part  of  law  enforcement,  but  starting  from  the  premise  that  everybody  is  acting 
with  good  will  and  honest  - and  perfectly  honestly,  even  still  it's  difficult  to  be  sun ShSSJSb  fcSJ® 
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used  to  collect  information  from  packets,  in  the  way  Carnivore  does,  are  behaving  faithfully  and  reliably. 

In  particular,  there  is  a strong  possibility  that  omissions  of  collected  data  or  garbling  of  collected  data 
could  cause  misleading  results  that  could  put  information  collected  out  of  context,  or  collect  data 
inadvertently  that  should  be  attributed  to  another  source  or  destination  than  it  may  initially  appear. 

S?er  flotv.0  Tltmmu  Wfy’  unf°rtunate1y  “ we  in  the  computer  security  community  learned  this  over  and 
over  again,  these  are  hard-  won  lessons  ~ them  s no  systematic  way  to  deal  with  large  complex  systems  of 

seSt^cnST^&on611  ^ &nctIOn  ofthe  soft%vare  is  security-critical  Certainly,  Carnivore  is  a 

Sev°l 2 {„PfSfv^5&!{ieS  <^ptex  secure  systems  is  that  very'  often  they  fail  silently. 

mJZ  *w?k  *V  thatleadf  .^e  observer  to  believe  that  they  re  working  properly,  but,  in  fact,  subtle  bugs 

mean  that  there  are  vulnerabilities  or  mistakes  there  anyway,  b 

So  we  have  the  problem  of  being  concerned  with  the  reliability  of  data  collected  by  a complex  piece  of 

rCwI  the  problem  of  ensuring  that  something  connected  deep  within  the  infrastructure  of 

S^^Shv^^>frOV,do  * 5tSelf  vtulneraSe  10  ******  tampering  or  could  itself  be  - have  control 

taken  over  by  a malicious  third  party  who  is  able  to  get  access  to  it  by  exploiting  some  bug. 

There'xe  two  ways  that  we  stumble  along  in  trying  to  assure  ourselves  that  complex  systems  that  we  want 

^ f?cused  revicw  by  “P®5  hy  *“««.  “d  I 

strongly  adv  ocate  that  the  kind  of  focused  review  by  independent  experts  that  was  discussed  in  the  first 
panel  be  done.  But  there  are  limits  to  what  a limited  set  of  experts  can  ever  discover.  We  discover  again 
and  again  that  even  after  a security  audit,  new  information  comes  out  about  the  environment  in  which  the 
software  may  be  used  or  something  may  have  been  missed  by  the  pane!  of  experts  that  could  only  be 
known  by  widespread  publication  ofthe  source  code  and  details  ofthe  architecture  ofthe  system. 

The  secunty  community,  pretty  much  unanimously,  supports  the  idea  that  source  code  should  be 
published  for  any  system  that  performs  a vital  security  critical  function.  And  1 think  the  Carnivore 
system  as  a very  good  ex  ample  of  this* 

°£illf  obiecti°n$  raised  to  doing  this  in  the  case  of  Carnivore  is  that  it  might  provide  aid  and 
comfort  to  the  targets  of  investigations,  who  might  find  ways  to  circumvent  the  system.  I think  in  the 
case  of  Carnivore,  the  existence  - the  mere  existence  and  the  architectural  details  ofthe  Carnivore 
system  don  t really  provide  much  help  to  the  - to  someone  who  wants  to  evade  it.  It's  v'efy'much  like 

uUH  SKhSHS  SKSS^""" be  in!eres,c<i  >n  m ,he  d“i,s  of  wtehK  • “ 


Ca^vorelnkaUations’  n°  ^ advocates  PybHshinS the  Stalls  - the  operational  details  of  specific 


rfomn;end  that  " that  either  - that  while  neither  focused  review  by  independent 
experts  nor  publication  of  source  code  are  panaceas  and  ensure  against  any  possible  problem  or  abuse. 
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M tJtes®  are  essentia!  steps  — widely  recognized  essential  steps  that  certainly  should  be  done  in  this  < 
■ g And  I hope  that  will  happen. 


Thank  you. 


CANADY:  Thank  you,  Mr.  Blaze. 


Mr.  Baker? 


BAKER:  I've  been  on  both  sides  of  some  of  these  debates.  And  I have  to  say  I see  both  sides  of  this  one.  I 
think  in  some  ways,  both  sides  of  this  debate  are  stuck  in  a - in  the  telephone  world.  A lot  of  the 
witnesses,  some  of  the  questions,  suggest  that  maybe  we  could  solve  this  problem  by  having  ISPs  take 
responsibility  for  doing  these  intercepts  themselves. 


And  actually  I think  the  FBI  has  got  this  about  right.  If  the  ISP  wants  to  do  it,  then  they  should  do  it.  But 
a you  tnko  an  ISP  — a small  ISP,  and  tell  them,  "You  have  to  do  it/'  they're  going  to  treat  this  like  an 
expensive  unfunded  mandate.  And  there's  no  reason  why  they’re  going  to  do  it  more  enthusiastically  or 
more  privacy-  protectively  than  the  FBI.  In  fact,  there’s  going  to  be  less  oversight. 


Dus  is  not  the  phone  company  that  could  just  hire  somebody  to  do  the  wiretaps  every  day  and  add  it  to 
the  rate  base.  They're  not  going  to  be  doing  what  people  saw  the  phone  companies  do  by  way  of 
protection  if  they’re  small  ISPs  and  they  don’t  want  to  have  this  role.  And  I’ll  tell  you  there's  plenty  of 
ISPs  that  really  don't  want  this  role  in  spite  of  the  noisier  ones  who  do. 


But  I think  the  FBI  and  the  Justice  Department  are  also  living  in  the  past.  To  say  you  don't  have  an 
expectation  of  privacy  in  information  that  is  in  the  hands  of  a third  party  in  the  internet  age  is  just  crazy  1 

mean,  our  entire  lives  are  in  the  hands  of  third  parties. 


Jo  treat  the  to  and  from  lines  in  e-mails  as  though  they  were  just  the  same  as  the  phone  numbers  that  you 
aial  is  also  bizarre,  w e know  that  the  phone  company  collects  those  phone  numbers  because  they  send  us 
a bill  with  those  phone  numbers  every  month.  No  one  expects  the  ISP  to  be  collecting  our  to  and  from 
lines,  especially  not  the  from  line.  They  don’t  use  the  from  line  to  deliver  the  message,  you  know.  That's 
just  content,  and  they  should  get  a Title  HI  order  to  collect  it. 


So  if  relying  on  the  ISP  doesn't  work;  if  this  really  is  a privacy  problem,  what  should  we  be  doing? 


1 guess  I would  say  a couple  of  things.  First,  as  Mr,  Nadler  suggested,  w'e  ought  to  be  sending  notice  to 
people  when  they  ve  been  subjected  to  this  kind  of  intrusion.  We  have  a system  right  now  that  protects 
the  privacy  of  the  crooks,  but  not  the  innocent  people  who  are  investigated. 


You  know,  if  Mr.  Davidson  were  under  investigation  - he  sent  that  e-mail  to  Mr,  Tavlor,  The  next  step 
that  the  police  would  take  would  be  to  put  a cover  on  all  of  Mr.  Taylor's  e-mails  in  and  out  It's  perfectly 
relevant  to  their  investigation.  They  want  to  know  whether  he’s  also  corresponding  with  other  crooks  that 
they  re  investigating.  So  they’re  going  to  have  60  days  or  120  days  of  Mr.  Taylor’s  in  and  out  e-mail,  just 
automatically.  And  he'll  never  know  it,  because  he's  not  going  to  get  indicted  and  get  to  see  that 
mtormatioiL 
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There  ought  to  be  notice.  Only  you  guys  can  make  that  happen. 


There  ought  to  be  oversight.  The  audit  provisions,  again,  are  very  protective  of  crooks,  but  not  of 
innocent  people.  Tire  criminal  defense  attorneys  are  going  to  get  to  see  this  and  they’re  going  to  be  able  to 
follow  that  audit  trail,  but  Mr.  Taylor,  if  his  e-mail  has  been  intercepted,  isn't  going  to  get  a chance  to  see 
that  audit.  There  needs  to  be  somebody  who  will  do  that  audit  on  behalf  of  ordinary  citizens;  we  shouldn't 
be  relying  on  criminal  defense  attomies  to  do  that  for  us. 


Last  point,  if  you  want  to  do  something  about  this,  you  probably  ought  to  do  it  pretty  quickly  . That’s 
because  Carnivore’s  not  the  only  way  in  which  this  is  going  to  happen.  Tire  Communication  Assistance 
of  Law  Enforcement  Act  had  a provision  that  said,  well,  everybody  has  to  provide  trap-and 
trace-capability.  The  FBI  has  said  that  means  packet  data  carried  by  carriers  has  to  have  a trap-and-  trace 
capability.  The  FCC  has  said,  We're  telling  everybody,  you've  got  to  have  something  installed  - all  you 
earners  have  to  have  the  capability  of  doing  this  trap-and-trace  by  September  of 2001 . 


BAKER:  We  aren’t  going  to  tell  you  how  to  do  it,  but  we're  going  to  tell  you  you  have  to  have  it  done  by 


There’s  only  one  - well,  there’s  two  ways  to  do  it:  either  let  the  FBI  install  Carnivore  or  you  go  out  buy 
Carntvore  on  your  own.  I’m  not  sure  those  are  really  the  only  solutions  that  we  want  to  have  carriers 
have,  but  unless  the  FCC  backs  off  of  its  deadline  and  its  current  mandate,  that's  what's  going  to  happen 
and  it’ll  be  too  late  to  install  a lot  of  controls.  ri 


Thank  you. 


CANADY : Thank  you,  Mr.  Baker. 


And  last,  but  not  least,  Mr.  Sachs,  and  I apologize  for  not  having  more  table  for  you  there. 


SACHS:  That’s  OK.  I’m  going  to  be  very  brief  in  the  interest  of  time. 


My  name  Is  Peter  Sachs,  and  I m the  president  of  ICONN.  We’re  a small  Internet  service  "provider  based  in 
New  Haven,  Connecticut.  And  I believe  I’m  one  of  the  small  ISP  that  Mr.  Baker  may  be  referring  to. 


We  do  have  the  capability  - in  fact,  any  ISP  has  the  capability  of  supplying  the  FBI  with  exactly  what  it 
wants  in  a more  accurate,  more  efficient  and  more  private  manner,  because  we  have  absolutely  no  need  to 
look  at  anybody's  information,  except  for  the  actual  target. 


FRANK:  Mr.  Chairman,  could  the  witness  speak  up  a little  more,  please? 


SACHS:  Any  ISP  can  do  this,  in  as  little  as  two  lines  of  programming  code.  It  doesn’t  require  any 
machine.  It  doesn't  require  any  specialized  programming  skills*  beyond  the  programming  skills  of  a 
normal  system  engineer  at  an  Internet  service  provider. 


!itl|jiiSvcbJcxls^exis^ni^.um^?dS^)k5O05a45n92?6f6fae72B? 


To  confirm  this  statement  , l asked  my  system  engineer  to  set  up  a system  to  monitor  ail  of  my 
communications.  And  in  less  than  hour  he  was  able  to  see  evetything  that  was  sent  to  me  or  from  me  on 
his  machine  in  clear  legible  text.  So  there's  no  need  for  any  specialized  machine  or  any,  sort  of, 
specialized  knowledge  to  be  able  to  do  this. 

Carnivore  also  creates  an  extreme  security  risk  for  an  ISP.  To  allow  a third  party  to  attach  a computer 
especially  a secretive  computer  that's  accessible  from  a remote  location,  to  an  Internet  service  provider  is 
unheard  of.  It  just  provides  any  hacker  out  there  with  yet  one  other  doorway  into  which  they  can  enter 
your  network,  and  essentially  destroy  your  network  along  with  all  of  the  data  of  all  of  your  customers. 

f 

Carnivore  also  presents  a performance  hit  for  an  ISP.  The  moment  you  intercept  all  information  flowing 
over  an  ISP  s network,  which  is  what  Carnivore  does,  it  causes  a bottleneck.  Bottlenecks  cause 
slowdowns.  As  all  of  you  know,  the  Internet  is  already  slow  as  it  is;  slowing  it  down  even  further,  doesn't 
help  matters  much*  * 

Lastly,  it  may  have  a chilling  effect  on  the  information  that  ray  subscribers  or  any  ISP  subscriber  sends 
over  the  Internet.  If  you're  not  going  to  send  something  because  your  afraid  of  its  content  or  perhaps  iust 
its  destination,  it  raises  very  valid  First  Amendment  concerns. 

If  tlie  ISP  gathers  the  data  for  the  FBI  under  a court  order,  the  FBI  can’t  possibly  see  anything  it's  not 
supposed  to  see,  because  they're  only  getting  what  we  give  to  them.  If  the  FBI  does  the  work,  they  at  least 
have  the  ability  to  see  anything  they  want,  and  they  do,  in  fact,  have  the  ability'  to  see  anything  they  want 
t he  former  method  protects  privacy  and  the  latter  method  invites  abuse. 

Since  the  ISP  can  provide  the  ISP  with  exactly  what  it  wants,  without  imposing  upon  the  privacy  rights  of 
all  the  subscribers,  why  Carnivore?  Why  use  the  most  intrusive  means  if  the  least  intrusive  means  are 
readily  available? 

Thank  you. 

CANADY:  Well,  1 want  to  thank  all  the  members  of  this  panel  for  your  very’  helpful  testimony. 

I just  have  one  question,  related  to  Mr,  Sachs’  testimony'.  Mr.  Sachs  has  testified  that  doing  the 
interceptions  or  executing  a trap*  and-trace  or  pen-register  order  is  a simple  matter  for  any  ISP;  can  be 
done  m an  hour  just  a little  programming  and  there  it  is.  Now,  that’s  not  consistent  with  what  the  FBI  has 
told  us  their  understanding  is. 

And  let  me  ask  -- 1 guess  maybe  Mr.  Blaze  and  Mr.  Perrine  would  be  two  who  might  be  in  the  best 
position  to  give  me  your  take  on  whether  it’s  closer  to  what  Mr.  Sachs  says  or  exactly  as  Mr,  Sachs  says 
or  what  the  FBI  has  had  to  say  on  that.  . 3 

Is  it  as  simple  as  and  I'm  not  trying  to  be  - single  out  Mr.  Sachs  here,  but  that’s  a fundamental  question 
ror  us  to  look  at.  Is  it  as  simple  from  - in  your  understanding  as  Mr.  Sachs  has  presented  it,  or  does  he 
have  a programmer  that  has  special  expertise  that  other  ISPs  might  not  have? 


PERRINE:  Well,  I can  address  that  from  the  standpoint  of  tracing  computer  intrusions  and  attempted 
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intrusions,  I would  say  probably  30  to  50  percent  of  the  ISPs  that  we  contact  don’t  keep  much  in  the  wav 
of  logs.  We  tend  to  deal  with  a lot  of  the  smaller  ISPs,  we  tend  to  see  the  same  ISPs  ~ the  problematic 
ISPs  over  and  over  again. 


I think  that  it  s fair  to  say  that  many  ISPs  could  solve  this  problem  if  they  were  motivated  to,  but  it’s  not  a 
profit  center.  They  aren’t  making  money  cleaning  up  or  preventing  computer  intrusions  at  other  facilities 
and  they  certainly  aren’t  going  to  make  any  money  providing  information  to  the  government. 


PERRINE:  They're  not  financially  motivated  to  do  it.  Some  of  them  have  the  technical  capabilities  and  I 
would  have  to  say  that  there  are  some  of  them  that  do  not. 


CANADY:  Mr.  Blaze? 


BLAZE:  Sir,  I'd  just  like  to  - from  a technical  perspective,  the  answer  is  like  most  subtle  technical 
questions.  It  depends. 


Die  problem  with  a system  like  Carnivore,  from  the  point  of  view  of  complexity,  is  that  it  has  to  be 
general  purpose;  it  has  to  work  under  a wide  variety  of  operational  conditions;  and  it  has  to  work  to 
collect  a wide  range  of  kinds  of  information,  depending  on  what  the  court  order  is  asking  for. 


Some  ISPs  may  already  have  in  their  network,  for  example,  logs  of  information.  They  may  have  for 
example,  port  replication  capabilities  on  switches  that  allow'  them,  much  more  conveniently  than  an 
external  tool,  to  collect  the  kind  of  data  that  Carnivore  or  a Carnivore-like  system  could  only  collect 
with  some  trouble  and  with  some  difficulty  assuring  yourself  that  it’s  operating  correctly. 


In  other  cases,  there  may  not  be  the  exact  capability  required,  so,  it  depends. 


PERRTNE;  Ifl  could  just  add  — if  the  equivalent  of  Carnivore  were  available  in  open  source,  that  would 
make  the  ~ that  would  lower  the  barriers  to  entry  for  the  smaller  and  less  technically  capable  ISPs  to 
provide  this  information. 


And  I think  that  this  is  something  that  is  quite  feasible.  It's  not  a six-day  project,  it's  not  a six-year  project 
it  s probably  on  the  order  of  I think  maybe  three  to  nine  months  at  the  outside  for  the  open  source 
community  to  reproduce  large  parts  of  the  Carnivore  system.  And  that  would  make  it  easier  for  smaller 
ibPs  to  provide  this  mforroation  themselves. 


DAVIDSON:  Could  f just  jump,.. 


CANADY:  Mr,  Davidson,  sure. 


DAVIDSON;  Perhaps  part  of  the  problem  in  coming  up  with  an  answer  is  that  we  don't  know  exactly 
what  Carnivore  is  doing.  There  seems  to  be  a certain  subtlety  of  analysis  that  the  FBI  is  seeking.  And 
perhaps  the  FBI’s  interpretation  of  what  numbers  dialed  on  a telephone  is,  in  terms  of  extrapolating  it  to 
the  Internet,  might  be  different  from  what  many  of  us  would  think  it  would  be,  J 
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St"’ tao^tatS^'to'  q"'Sti0n  ^ *h"te  1SPs  - *>  «*“  Carnivore  does  until  we,  3 
CANADY;  Well  I understand  that.  But  I also  understand  the  FBI's  problem  with  making  the 
SS'SS'1  may  that »»>*  ***P  —«  product  C could t used  to  fte‘  wav 


m the  way 


^^^^alc'th^you  ^o^flo^d^ogqiKaiwisfiom^^mraittee  and 

And  I recognize  the  gentleman  from  North  Carolina,  Mr.  Wait 
WATT:  Thank  you,  Mr.  Chairman. 


And  m the  interests  of  time,  HI  tty  to  be  very  brief,  too.  I've  got  two  technical  questions  also. 

Am  fmSak^n  p?jslbibt>'  °^inS  something  similar  to  Carnivore  on  an  open  source  basis 

to  *1 -«f  P^f  Wouldn't  that,  in  effeS  mSe 

Carnivore  syste^s^lM^^^^lo^^^o^yvflolenfM?'11^  ‘ ”*  “ “ Radte  aaCk  m<1  »“*  « * 

SlSy^iR^1!  •”» °«  **  Carnivore  appears  lobe  functionally  similar  to 
today.  He  special  S th^^d  r^,2*“‘“g  SyStera;  &ee  operattoe  S>'SK™ 

ffi^goulU^ 

and  also  that  it  can  monitor  higher  speed  networks.  And  I believe  that  that’s  nrobablv  Ln  a u UL 
of  the  proprietary  code  is  is  in  the  very  high  speed  monitoring  probably  where  a large  part 


^nhobtS|.Ve  thSt  Uiat'$  Pr°bab1y  Wh8re  3 large  part  of  tfie  proprietary  code  is,  is  in  the  very 

But,  as  other  people  have  mentioned,  the  idea  is  to  neck  all  of  the  large  nines  .-in™  in  • . 

5SBT  ^ ** if ' *“ » - d0  ** *»  <k'y  d»nt  need  S SSbl^TSST 

And  I drink  Matt  has... 

nitbif  « l— S; 1 address,ed  ,some  oCthls  in  my  written  testimony.  But  the  important  noiM  is  that  then's 

F f °Ui  ^e>asic  ^tonality  of  network  sniffm.  Ifrey’re m 2SEto5  used  bT 
anyone  who  has  to  administer  a network,  such  as  an  ISP  or  a local  ir<»3  t I • . * usedr^ 
are  common  place;  they’re  widely  available.  ' rl  admmistrator-  These  tools 
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sstfsass£sss55S?^^ 

don  t pro\  ide  additional  interception  capabilities,  bnt  rallier  provide  these  Jeeal  assurances  and  chains  of 

aid  “b“d%^  °P“  “““  W0UW  b'nefi‘  gr“,y  *>””  *“*  to'  provide  any'g^t 


WATT:  Mr.  Baker,  it  looks  like  you... 

h&V-n  f *fy 1 “k&e  FBI  is  right  on  this.  If  you  publish  exactly  bow  you're  filtering  this 
JSSwmeS?  ° Wnte  th6Ir  e'IBS!l  addr£SSeS tod  sP°ofth^ addresses  m ways  to  afoid  that 

It’s  really  not  the  best  idea  to  publish  this.  I think  the  likelihood  that  the  public’s  - the  open  source 
community  is  gorng  to  embrace  Carnivore  as  a project  is  about  zero.  There  are  Going  to  fee  vSy few 
benefits  from  doing  that  and  a lot  of  costs.  b h 10  DC  verj  IeVt 


S°»i?fieVjre  m!sfd  an  lssuc  {|iat  1 want  t0  not  have  him  address  because  he’s  already 
matbe  K tec}u”cal  caPa5i{>'  address  it,  but  Mr.  Blaze  and  Mr.  Perrine  and 
remotely^  ’ >b  M * S h * M Com'Revere  ra,sed  the  Prospect  that  Carnivore  could  be  accessible 


1 tltink  1 understand  what  that  means,  that  you  could  - the  FBI  could  sit  in  an  office  somewhere  else  and 
m^Revem?^111  ^ mantPu!ate  « from  some  remote  location . That’s  what  you  intended,  Mr. 


CORN^RE'VERJE:  Tliafs  correct 


since  Mr-  Cm*Bm  docs"'1  «* 

PERRINE:  Actually,  I believe  that  is  the  case, 

WATT:  It  can  be  remotely... 

PERRINE:  I believe  that  is  the  case,  1 had  a very-  limited  time  to  see  it,  but  I believe  that  is  true. 
WATT:  Mr.  Blaze? 


answer 


precisely  whS wiP^wVm * ? b* md  necessU>’ to  be  reraotely  controllable  and  configurable  is 
SotenrSlv  tfinf ! h cof  Puter  sscunty  community,  are  made  very  nervous  by.  That  capability 

fro  impkmeTlted  ver>'»  vei>'  carefully,  could  allow  an  external  attacker  - third  party  -■  to 
gain  control of  the  system  and  potentially  do  quite  a bit  of  damage.  party  to 

WATT.  Mr.  Davidson,  Mr.  Sachs,  if  you'll  address  that  same  question  quickly.  Til  leave  everybody  else 


^ of 
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Carnivore  machine  is  going  to  be  out  there  accessible  remotely  means  any  hacker  can  get  into  a system. 
If  they  could  get  into  the  White  House  and  hack  that  site,  they  can  get  into  an  ISP  through  Carnivore. 

g ?n  configurations  remotely  to  the  extent  that  it's  possible,  I mean,  I think 

inSSSE™  nfil  K &?{  d ^pefUjly  think  exists  where  an  ISP  at  least  is  in  some  ways  an 

intermediary  of  how  the  device  is  deployed.  And  so  that  raises  another  concern, 

WATT:  Thank  you,  Mr,  Chairman. 

CANADY:  The  gentleman's  time  has  expired. 

The  gentleman  from  Alabama  is  recognized  for  five  minutes. 

BACHUS;  Thank  you. 

a”y  ^ifaiethat  any  of  you  can  think  of  why  electronic  mail  or  information  traveling  over  the 
pnvSe  maii?  d *****  **“  protectl0n  lhan> say’ 3 Person’s  telephone  calls  or  their  faxes  or  either  their 

■4 

: N°'  T,°  the.contrary.  I think  that  in  fact  it  should  have  at  least  as  great  a protection  as  we 
currently  give  to  voice  communications  for  example  in  Title  III.  There's  a crying  need  reallv  for  the 

of  nm?cvthaf  I thl  f e.f  ,Coinmunications  Privacy  Act  to  bring  it  into  line  with  the  expectation 

tf  privacy  that  I think  that  Mr.  Nadler  suggested  and  that  most  of  us  have.  P 

our  mosTnrk'stP^ Xwuf °Y  m°f  !mPortaot  communications.  Involves  our  most  sensitive  data  and 
our  most  pm- ate  thoughts.  And  we  do  need  to  bring,  those  into  line, 

SrnstnS^nli011 " tfI  **2  forjUst  8 second  ~ the  administration,  I think  partly  in  response  to  the 
Carnivore  controversy,  made  some  suggestions  the  other  day.  Mr.  Podesta  made  some  nronosak  In  mv 

loSthat  6 g°ne  °Ugh  th0$C  proposals  in  some  detai!'  W“»  y<>«  get  a moment,  I urge  you  to  take  a 

TweiMn?t&SS!^iS  “1  Poin|* 115056  proposes  are  not  a solution  to  the  Carnivore  problem. 

whSfffthS  it  ^ *c  ™aPP^g  ^ws,  doesn’t  get  to  the  heart  of  the  Carnivore  problem, 

wmich  is  that  it  is  a device  that  does  allow  the  FBI  to  filter  through,  potentially  to  canture  hove  volume 

of  communications,  most  of  which  are  completely  unrelated  to  the  target  of  ttie  investigation  8 


force  a service  provider  to  install  a device  like  Carnivore. 


i 

authority  to 
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BACKUS:  Mr.  Davidson? 


DAVIDSON:  In  the  interest  of  time,  Fd  rustlike  to  sav  ditto  And  4dd«n*nAW  *„u;~u  • <u  . 
really  Just  the  tip  of  the  iceberg  here.  } ‘ And  add  one  Pom(’ which  IS  th«  e-matl 


IS 


toW.^f*«5?*  part  °-the  p0mt  1 **!  t0  m2ke  k that  the  home  has  explored;  tilings  that  we  used 

°f  0nt0  a netWOrk' Mdms  is  a *w«>  ftat's  only 

S^S2SSSS?SSSSi5SiSS^^  ^o«t  ^ &n« 

greatly  diminished  I SSit-l 1 ff  ^ *H! ^.ofj protection  is  has  under  the  law  is 
Sth  that  ^ ^ & 1 7 h aIknge  here  for  Uus  Confess,  to  think  about  how  we  deal 

=SSSj^^£5;SESS'SSi3.1.t 

Anyone  else  wish  to  comment  on  that? 

I read  a question  to  the  first  panel  which  was  that  you  can’t  go  to  the  AT&T  and  sav  WeVe  mhn  ir. 

sys,em- 1 thai's  “*•  ■*«*»  &>■*  *>  lu,  isn't 

devi“- thc  kW  ,ta  Mr'  ^SSSSS.  - -Ha, 


susSvbuHt^lSl^ thS  !fga^asis  for  doin« that  to  *»  hitemet  sendee  provider  is  at  least  equally 
suspect,  out  it  may  take  an  act  of  Congress  to  clarify  that  point.  equal  ly 


BACH11S:  I think  clearly  the  marketplace  and  technology  has  outrun  the  law  and  m dnin*  ™ Kac 
our  legal  protections  that  have  been  in  the  law  for  years  * W domg  has 


; overrun 


experiences,  what  procedures  are  typically  followed  to  notify  customers 

^at!s  a ver>'  mixed  bag.  And  it  depends  entirely  on  the  policy  of  the  ISP  Some  TSP*  have  a 
policy  of  sending  notice,  others  do  not.  There’s  no  requirement  ene  my  22o£t 

« £?, ^The  8<,Vemm“' P,0iMy  Sh0"“  *»  ««Nl  i".  “tar  titan 


BACHUS:  It’s  my  understanding  that  what  they're  saying  is  they  don’t  have 


to  give  notice  if  there’s  a 
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expectation  that  if  they  gave  notice  the  communications  would  stop.  And  I think  in  eve-rv  «~ 
here  they  gave  notice,  it  would  he  a reasonable  expectation  that  the  communications  would  stop,  so. 


^«f«^nceS,  we  have  delayed  notice,  and  I think  that  that  s 


serves  a 
“ At  least 


CANADY:  The  gentleman's  time  has  expired; 

The  gentleman  from  Michigan,  Mr.  Conyers,  is  recognized, 

i 

C^NYBRS.  % ^1, 1 begin  by  thanking  this  second  panel,  because  this  has  served  as  a very  important 
corrective  for  what  we  were  just  told  for  a couple  hours  earlier.  And  Vm  sorry  to  hear  tha?w7S?to 
move  very  rapidly  on  tins  lustier  thf*  jr4r>/*i*  *e  ^ ^ 


we're  going  to  have  to  indulge  in  F P 101 3 ,BUCB  aeeper  mv**'8*ti<m  *&* 

Let  me  thank  specifically,  though,  the  American  Civil  Liberties  Union  because  thev  in  addiHrm  n,;<. 

And  so  I'm  glad 


Is  there  a feeling  that  we  should  probably  try  to  require  that  notice  be  given  to  those  who  are  the  nkieetr 
of  a trap-and-trace  measure,  or  is  that  getting  a little  bit  too  fine  - cutti J 

requirements  on  the  Department  of  Justice?  ung  ioo  ttne  a line  ui  the 

Mr.  Cora-Revere? 

OQK1WIEVERE:  Well,  let  me  just  address  that  question  in  the  context  of  the  previous  one  and  that » in 
the  ease  of  an  ongoing  investigation,  like  with  the  trap-and-trace  order  the  ISP  is  exnresslv  5 

mv  estigated,  then  the  communications  wall  cease.  So  there's  no  notice  before  the  fact.  S 

be(TV?fe  al  }fst  t0  chail8e  *e  law  so  that  anyone's  who's  been  the  target  of  a 
surveillance  be  notified  after  the  fact,  as  currently  is  the  case  with  respect  to  a Title.III  intercept  order. 

?J¥PaS?:  1 vTld  juSt  -add  ** 1 actua{5y  ^ink  that  there  are  two  more  important  thmas  for 
Internet.  secona  18  waning  what  trap-and-  trace  and  pen  register  mean  for  the 

Sp" 

because  there  s no  reasonable  expectation  of  privacy  on  that  information.  ’ 
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Smith  S?lSKMdUrtSXS^l^&'Tri,i  U""  rre  rcally  <ta‘ address  ■«. 

co«  had  to  id  j£  23?  UK  to»Sny'  “ s ,0  »hai 

hear  sound.  They  disclose  only  Ihe  teSrae  eSSI TTTff4' TheK  devlces  do  "<* 
Mmmumoato.  Neither  the  report  ofly  communicate  hS fte  tSta-’Ste^SSfeall 
their  .dentes,  nor  whether  the  call  was  even  completed,  is  disclosed  by  pS  retire  P °f ' lhe  CaI1’ 

s from  tlie  kind  of  information  thafs  acquired  with  resneer  rh 

of  many  othe?Sl  w?h  e-mtolXelSy,'if  yS'ahto  to  geuK  ^>ES  1°d  f“'S 


“sM'ScOTtet’of  a M*  tosw  SnZaS*le  °r  ia  comPlcK1>'  different  from  what 

ag0.  oi  a pen  register  when  the  Supreme  Court  addressed  those  issues  some  25  years 

fx^SteiSSfo^S*’  **■  COn5,m- ,hmk  y°“  f“  »•«««**  fc  «»  ACLU.  i'll 

* ««  now  for  law 

d^«  onitf«  i?s  cSSiST i gssr,i>a?nce  u,e  <“*»•  »•**■  *• 

a changing,  because,  as  new  technology  comes  on  - a£  tte™  53SS , ’ *?  a comPlex’ 1 «f 
of  assurance  that  it  may  not  he  as  big  fc  i,  secntsto  bSftffiS&SS! 5S2ft‘MSSTTr  WOr<IS 

(CROSSTALK) 

CANADA : The  gentleman's  time  has  expired. 

And  the  gentleman  from  Arkansas  will  be  recognized. 

HUTCHINSON:  Thank  you,  Mr.  Chairman. 
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to^/iwWal^na  * 


wfl^f  f bff  * during  SO?e  of  tWs  testim°oy}  but  I want  to  assure  everyone  that  I've  read  vour 

present  during£p?eS  paS  tSSr TSdVd  “ m*? * *fA  ^re  probably  was 

perhaps  Mr. #tS5  P tetrmony,  and  Idjust  hke  to  ask  a genera!  question  to  Mr.  Davidson, 


fr^whaU  Sered"  tomtits  °f  ^ ^0US  pa-ne!?  Mjmi  like  t0  ask  a taction  as  to  ~ r mean 
Carnivore po|am is PTOc^de7by 15  *’  ** 01  *% eve^hfe8  though  to  the 

&ere  s^uJd  be  sorae  ^dependent  review  of  the  source  codes  And 
i mm  mats  something  I had  a discussion  with  them  on  - you  know  they’re  suWHtoaTt*  «,im  . 

“odd  bo soloupe otonXs 

(o  .nunimize  it.  And  so,  if  you  could  just  commented  whether  you  diw^ee  oi^^y  ofthose^o^lusiOTS? 
Mr,  Davidson? 

thtoktofSS  stf*  h?  *a>>ng; 1 ,think  some  of  those  things  actually  sound  good  And  I mean  I 
think  the  idea  of  trying  to  mmiimze  inforaiatioo  that’s  collected  in  -t  mmivt  Tf^t-11  , 1 

surveillance  is  a good  tiling.  coiieuea  in  a context  of  an  Internet,  you  know, 

HUTCHINSON;  And  how  wou!d  you  suggest  doing  that? 

1 1 “*  is‘?"y  good  one.  [f  thore  oeod,  to  be  , 
opening  it  up  to  the public.  P P here’ that  s not  die  same  a*d  * wouldn't  be  as  good  as 


jr  ■;  — **  z * f,vaxw»  w^u  i wu  i uuuK  n cm  oe  mat  usemi  a iftht*  hvA 

£S2 5 SSTtoT  g0h  d can  if  be?  **  ^ Sat  - 

group  in  here  for.  P g P 6 ’ But  maybe  that  s what  we  ^ get  an  Independent 


I think,  but>  you  know,  from  a greater  point  of  view,  there's  sort  of  thk  i*™#  u 

this  desire  on  the  part,  I think  of  law  enforcement  to  be  able  to  extrapolate  everv  current  esnltomtfVv 
pen  registers  or  trap-and-trace  orders  into  the  Internet  world  Th/>  rJL  ic  *i>  * ent  capability,  like 
them  don’t  translate  very  well.  W‘  ^ f 1S’ that  when  you  do  *at,  some  of 


Pen  registers  is  probably  tlie  example  we’ve  talked  about  the  most  here.  When 


yon  - we  don't  know  what 
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bttp^/webJexb-nexis,coKx/b,unl^»d5s:;<)bcf305245 1 79276ft>fae?2fy 
tkcy  .amt  fa  the  Internet  world  when  we  tty  to  extrapolate  them,  we  get  a tot  more  information... 
(CROSSTALK) 

HUTCHINSON.  \ou  suggest  a higher  standard  for  a pen  register  for  Internet  access? 

Absolutely  a higher  standard  and  a clearer  definition  of  what  it  meam  Rm  j o,i„.  *u  « 
got  to  be  an  understanding  that  some  things  thev're  coins  toTiS  r “ <?  1 ^ there  §- 
capabilities  that  the  FBI  is  petfintf  at!  thf.  i S°mgio  De  ante  to  do  - 1 mean,  there  are  new 
“ < 1 1S  gettuig  aI1 5he  tim&>  because  of  the  sea  of  information  that’s  out  there. 

2£SS8m  m?*Tsomfo^^^  «*« !» ».vo  to  bo  a 

hot  necessarily  a horrible  thtog.  There's  goingto  be  tots  of  new  took ‘tor  faw , eSeSus  f eh.'""’  B'‘ 

HUTCHINSON:  Mr.  Steinhardt? 

'h‘S<,vernmentP»«l  nrised  mote  questions  than 

Carnivore  is. lea’s! a, So  mS.  STS  he  taotato„'S8f  ‘ *>* «?  oni>’  «*»  «* 
interception  of  e-mail.  a m implication  was  to  be  primarily  used  was  the 


demonstrSI;  fofeJai£Sr™bers  ofthe  press  ?“  °fth°*e  - 

Carnivore,  that  it  is  capable  of  analyzing  and  potentially  mterceotine  far  mnrMb  - en?onstratmriS  of 
a whole  range  of  Internet  protocols  which  Carnivore  is  LnS  5 ? n n } e’raaiK  T1iere  «e 

to  those  here  today.  is  capable  of  filtering  for.  Ibere  was  some  allusion 


HUTCHINSON:  Could  I interrupt  you  here  for  a s 


second? 


STEINHARDT:  Yes. 


order  that  testrems  the  use  of  gathering  techniques,  .tad  so  there's  almyTcoSiaces  to  ttal  ““ 
taiK”SYcourtTrdeTy  °f  ,hcse  be  abuKd'  “d  lhe!'  «uld  gather  more  information  but  they're 


STEINHARDT:  No,  no,  perhaps  I wasn’t  clear  Congressman  Hutchinson. 

“sh  15  *”’*• bec,use 


re  — we  need  to 


\6M7J 


ft  7& 
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gotten  fifes  through  the  file Transfer cSSSSTT  ST*  ?,f,case  7 had 
Question,  but  I think  there  are  serious  question  about  whether  or  not  exktxnv  law  « **?  m^° 

for  example  with  a trap-and-  trace  order  S mg  laW  pemj,ts  them  to  8*  that 


HUTCHINSON:  Thank  you. 


CANADY:  The  gentleman’s  time  has  expired. 

The  gentleman  from  New  York,  Mr.  Nadler,  is  recognized  for  five 
NADLER:  Thank  you  Mr,  Chairman. 


minutes. 


I have  a senes  of  questions. I hope  the  answers  will  be  brief  because  of  the  time  limitation. 
fcS  IfeSSte  2S”  is..kW  ?f  «i®» that  there  are  mar 


(here  So.  you  could  have  a 

SwSncd?  *"  3 S°m  ofinfOT*,io"  ''iotatoS  people's  privacy  and  how  woSld  we  know  £ it 


has  happened? 


S ^wSKffllavoX'Sihlm  o8ff,rK,”ly  “vai,ab.,e  “ifr“P(0g(em  » violate  some  one's 
tile  hart  part,  getttag  the  sSftiva  “to  dfthScepSn  " 0V'r th3!  ,rafiic  fl‘nV!'  Tha,'s 


NADLER:  That's  what  the  FBI  is 


BLAZE:  Right. 


us  to  let  - to  mandate  the  ISPs  to  do  in  this  case? 


NADLER:  OK.  Thank  you. 

And!^  accessibility  of  the  FBI  - of  the 


Carnivore  system. 


> change  evidence  and  implicate  so 


a motivation  to  do 


BLAZE,  ’ft  ell,  the  answer  to  that  depends  on  the  security  of  the  remote  access  mtpm  re  to,  ~ , . , 

m a secure  manner,  then  the  chances  of  that  are  very  small  If  it’s  X lfjts  «np5emented 

then  the  chances  of  that  become  quite  great...  V ' U * s ™plemented  m m ^secure  manner. 


Lt£  3SSrme’  Iet’s  as*ume  11)31 11)8  P°lk«  were  under  some  - we  know  that  this  has  hatmened 
Xei^e  StThd?  S ™df  5on,'1?I?t  pressure  to  solve  some  heinous  crime  and  ftey 

S ££SnlV"  8,VC  “ llWe  ra0re  evi<,e”“-  C™M  «*T  <®  the  Carnes  to.  is 
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^ ^^Jexb^WKlMO^ 

&e  aUditS  “* iropkmen{ed  m<i  “ 0110  of reasons  that  open 

NADLER.  So,  the  answer  is  yes,  unless  you  put  in  safeguards  to  prevent  it? 

BLAZE:  Yes,  that’s  correct. 


6fa47? 


NADLER:  OK,  so  we’d  have  to  stake  very  clear  that. 

/ 

*£  yo"  say  ">«  S»A  He  _ whatever 

« only  be  issued  on  the  teis  of  an  K*" 

to  believe  that  the  target  of  the  order  has  or  is  about  to  coLito  )fthHe  1S  reaso«able  cause 

the  same  thing  as  probable  cause,  or  you  mean  something  difflfentT  B reaSonable  **“*•  >*ou  raeao 


STE1NHARDT:  Well,  it  a slightly  lesser  standard  that  probable 


cause. 


SfflC  £S5?S£^^  »Ss;ttta'ma  Mbm 

disaetomOT down  He  SS^T^S  Si?  ,1°™  !,?Spf?  ?«‘tiflfa,ion;  the  judge  has  no 


ge  has  no 


reasonable  expectation. 


wheto  people  do  have  . reasonable ’ZZSZj&XS S£3£ES,  , 


•'  cause 
you 


NADLER:  And  you're  suggesting  that  for  the  Internet.  You're  not  suggesting  that  for  telephones? 
STEtNHARDT:  We  believe  - no,  we  are  suggesting  that  for  the  telephone  context  as  well. 

ea^mion^Tpri  vacy  is^  Ha^  the^preme  Owrt  se^ed  to  thinlfft  w^s’yTaR’ag’o? 

‘ STEINHARDT Yes,  I think  dearly  it  is,  yes. 

NADLER:  Why  do  you  say  clearly  it  is? 

reasonable  expectadon of^fac^in  the  numbers  ^Tdiai'and  iff t0  Jeam  lh?{  the>' 41011,1  have  « 
common  sense.  I think  the  Supreme  Court  decistondeffes  co^non  ° ^ 1 thkkthat<s 


NADLER:  Mr.  Baker  wants  to  say  something  on  this. 
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been  due  that  you  couldn’t  teH  whtttenhe  ca^lvvas  comok^uhT  wrote.?5  3*“*  a8°>  »*  might  have 
course  ofCALEA,  the  FBI  has  Sd on flSSdSS^SSf4*  hat  W2$  Said,3nd  the  «*»•  Butin  the 
gathering  about  calls  other  thS  Sen?  nS  0 an®nofm?«s  amount  of  transactional  data 
iong  yotf talked,  whethenvw^vi^^n^lTwairin^  trap-and-trace  orders:  how 

NADLER:  Whether  it  was  completed  at  all. 

i; 

fa  ““  ^ *°‘ off  ">  «“•  information  would  be  pat.  of  a 


KADLER*  On  telephones  today,  which  was  not  fee  ease  and  may  in  fact  — so  the  n *+  *r  - 

fa™  « dS,  ^ mighl  ““ ,0  '»  today  b«“  efc 

dSm^Stat!  A^dConross  XptSraVv  ^“kfa  3 <e!?> phrae  cont'xt-  <wt*My  ir 

Congress  s«  the  S,and”ds  fcr  «** 


md?oS  *i!  P“«l  ta  patrol  in  particular 

un  trammeled  discretion,  and  we  cannot  ahvavs  »«»m?n^'Sh°  ^ p0  ice  a®encies  cannot  be  afforded 
protecting  people's  privacy  *V  aSSUme  ^goodwill  or  even  their  lack  of  mistakes  in 

CANADY:  Hie  gentleman's  time  has  expired. 

»h 

The  gentleman  from  Georgia  is  recognized  for  five  minutes. 

BARR:  Thank  you,  Mr.  Chairman. 


SACHS:  That's  my  understanding,  correct. 

BARR:  And  no  supervisory  capability  whatsoever? 

SACHS:  That's  my  understanding,  correct. 

aSl!htt!h  did  **i  ^ow  if  did  me  md  I ^ink  it  did  Mr. 
waffle  just  a little  bit  - that,  in  virtually eve^lnstance  the^nlv  S™*  ?°?fh  th^‘ ofcourse’  aKva>'s 
last  hvo  years  in  which  they  used  project  Carnivore was  rinralv  £cm?J?hfrcfp  "5  U!l^tances  over  the 
could  not  satisfy  them  that  they  could  provide  the  informaiiS^ 
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FBI  Is  Pressured  ® 
To  Discbse  Codes 
For  Carnivore 


DATE 

RAOlfAE^ 


»V  Tet*  Btmus 
"f  T,MJ  *'*>■>• 

l J^!  GTm'Tbe  Fecfcr;U  anwut  of 
in  dkrtm  T JS  um!er  increaslngr  pressure 
So  ^setose  I he  secret  blueprints  for  its  Car 

SSSSr^  Wtom  so  independent 
?pem  can  verify  that  the  soft- 

« ^ °7’ !,le  Mwi*f  wtnnumi. 

cations  of  criminal  suspects. 

rev-Sf  «F 6885  10  MS  such 

dosfw  MmBio  !C  a s dis- 

the  softwares  source  code  would 
ate  hackers  to  find  ways  to  defeat  the 

aSSo^iSf^i*^  argll{?  tM  smh 

a oisetare  could  violate  copyright  protect 

nf°^f^eCaUfLCarnivore  Eludes  portions 
me  «S*f  towt  a product  licensed  to 

ttiegaverament  by  an  unidentified  vendor 
^Congress  « expected >o  press  senior 
FBI  officials  on  the  subject  at  a hearing 
today  before  a House  Judiciary  Committee 
M led  by  Florida  Republican  to 

3ef  & Zfy'  L17?akm  h3ve  ««H; 

».&s:B«anr 

. cw«as®as^'ssf 

fuJn?  seh^«^.wifnds?for  tM  hearine 
pMattbew  . Blaze,  an  -AT&T  Coro  re-’ 

®t>  failure  to  fully 
,d  setee  bow  Carnivore,  works  has  contr  b 

in  an  essay  published  on  the  Internet 
; ast  week.  Mr.  Blaze  wrote  that  releasing 
the  system’s  source  code  "is  a critical  first 

tfefSS 

to  d0  «&«  it  IS 

nSf  rffeeh  te' £kZe  <lMoed  Car- 
Rivire  s effectiveness,  suggiestm?  thsi 
even  modest,  electronic  f&  JSf 

| nSri^lonJlSfil0^  -’&«  it,  and 

al^— or  iDRt>e€at  users 
brJ^dktS^^  «»s  f® 

siTSKKrss 

feats  $y  describing  m remarkable  dJtoii 

^raaasaas s 

■™'se.  aeampry 


reseat ; 
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USA  TODAY 


Today's  debate:  FBI  and  Internet  privacy 


rm  eavesdrops  on  e-mail 
crashes  privacy  barriers 

1DTIIP* 


Purview: 

%en<y  says  it  targets  criminals. 
History  says  it  cant  be  trusted 

p*e  FBI  has  a knack  for  concocting  colorful 
code  names  for  crime-busting  toys.  The  iat- 
est  is  Carnivore"  — an  eavesdropping  device 
that  devours  private  e-mail  and  spits  out  in- 
teresting parts  for  scrutiny.  Not  just  crimi- 
tiais*  e-mail.  Anyone’s  e-mail. 

The  FBI  already  has  attached  Carnivore  to 
. e'ma"  hardware  at  some  internet  ser- 
vice providers.  Trough  it  won't  say  where 
the  FBI  says,  the  tod  has  been  used  fewer 
than  25  times.  Once  it's  in  place,  Carnivore 
acts  as  an  unrestrained  internet  wiretap 
snooping  through  every  Internet  communi- 
cation that  comes  within  its  reach. 

The  House  judicia  ry  Committee  will  ho!d  a 
hearing  today,  at  which  it  will  ask  the  FBI  to 
expiarn  its  actions.  But  in  the  IS  weeks  since 
Csnsvore  was  revealed  in  obscure  congres- 
sional testimony,  the  bureau  has  evaded  an- 
swer about  both  its  capabilities  and  pro- 
posed uses.  The  bureau  won’t  answer  even 
ttre  most  basic  questions  about  whom  the 
technology  targets'and  how  it  protects  the 
pnvaqr  of  innocent  Internet  users.  The  po- 
tential for  abuse  is  unprecedented* 

* W*0*  ^ intended  to  rifle 


► Why.  The  Congressional  testimony  that 
revealed  tire  existence  of  Carnivore  also  dis- 
closed two  other  systems  used  by  the  FBI  for 
; purposes:  "Omnivore"  and  "Ether- 
peek.'*  Why  weren't  those  revealed  earlier? 
How  many  times  have  they  been  used  and 
for  what  purpose? 

The  FBI's  response  to  those  questions  is  in 
i essence,  tmt  us;  weVe  ordy .after  oiminals 
and  terrorists.  But  even  a cursory  glance  at 
I law-enforcement  history  shorn  tliat  prom- 
ise cant  be  trusted.  Hie  temptation  of  gov- 
ernment to  coiled:  and  misuse  mfamiabon  is 
irresistible.  (See  box.) 

Further,  the  FBI  shows  no  inclination  to  ex- 
ercise restraint  In  every  aspect  of  eledmnfc 
private  - computers,  the  internet  and  cell- 
phones - it  has  pushed  invasiveness  to  the 
technological  limit: 

*•  in  1994>  the  FBI  lobbied  to  have  back- 
door access  installed  in  every  new  computer 
to  ease  electronic  snooping,  allowing  the  FBI 
to  defeat  security.  The  plan  was  dropped  af- 
ter the  National  Academy  of  Sciences  deter- 
mined such  access  would  make  all  comput- 
ers more  vulnerable  to  illegal  break-ins. 

► in  1995,  the  bureau  asked  for  the  capa- 
bility to  tap  as  many  as  one  in  100  phones  in 
major  ci  ties,  it  backed  off  only  after  a public 
outoy.  Lacking  such  technology,  no  totalitar- 
ian state  in  the  world  is  that  invasive. 

* in  1996,  the  FBI  proposed  liberalizing 

frhA  wwirt-  rtf  ^ i.  * i 


through  potential  criminals'  Internet  traffic  ►WmrITS  * **  m!astve* 
after  police  obtain  a court  order.  But  the  2 * h mf  the  m.  Proposed 
fives  the  FBI  tire  ability'  to  track  not  i JtS  J*  export  of  encryption  programs,  but  only 
individual  named  in  the  court  onto  but  also  fof--npanies  ti,at‘  under?Dlift  orrfer.  make 

everyone  who  uses  the  same  server  at  the  availabte  tQ  defeat  the  privacy  pro- 

Interoet  service  provider.  At  America  Online  graffiS' After  wo  fe£{erai  c011^  sh rock  down 

fe-  example,  that  would  be  thousands  of  tbe  ProPosal> tbe  administration  gave  up. 
people.  What's  to  keep  tire  FBI  from  snooo-  * ^ tbe  ^ wef!!:  *0  court  to  protect 

ing  more  broadly?  Only  its  own  assurances.  a P^n  tbat  wuld  alfow  cellphones  to  be 

► What  Coverage  so  far  has  focused  on  used  by  P°lice  t0  kote  tire  positions  of  their 

ore  surveillance  of  e-mail,  but  a program  U5et5‘  *^e  case  «*  court  today, 

that  can  snoop  through  e-mail  can  te  as  * Today,  the  thin  answers  the  FBI  has 
easily  eavesdrop  on  Web  surfing  sink  the  made  public  about  ^rnivore  «&e  mere  dis- 
information travels  in  similar  fomis  over  the  turt>inS  questions.  An  explanation  of  Canrsi- 

same  servers.  Wliat  information  wili  the  FBI  wre  m the  f®’*  Web  site  casually 

colfert  about  the  sites  people  visit  and  even  discusses  the  electronic  surveillance  6f  an 

tthe  ads  they  dick  on?  o*we  “facility, ’ without  explaining  how 

j * When.  Tire  FBI  admits  that  Carnivore  is  broad  such  e-snooping  oouki  be. 

jmoie  invasive  than  a conventional  ohone  1 fc  ead»^e.  tiie  FBI  gets  eonwiience.  The 

Jitap.  Yk  it  faces  no  more  restraints  than  tWse  1 P^S^ts  government  intrusion  on  a scale 
that  protea  telephone  conversations,  which  ‘ uae^ua5ed  ^ constitutional  history.  Abuse 
are  themselves  inadequate.  Since  Carnivore  ‘ ^P3^  & less-cfosely  watched  law 
t$  a greater  threat  to  privacy*,  shouldn’t  there  J enforrcmenJ  aSendes  Payback  on  tire 
tre  more  restrictions  on  when  it*$  used?  j technology. 


{ enforcement  agencies  piggyback  on  tire 
{technology. 


I>AT*C tMtDO 

HAG  R /fcA 


E-snooping  grows 

Court  orders  hr 
Attserica  Online 
customer  to: 

1 - As  «f  f«ty 

2tKWv  ACM.  Had  tt fret vf  cf  T'S 

akko  tiM«  ?oy  coffee*  f .J 
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FBI  fumbles  privacy 

The  FBI  has  a long  history  of  violating 
the  privacy  of  US.  citizens,  often  with 
political  motives.  Some  examples: 

► 1956:  The  FBI  rifled  credit  files  and 
criminal  records  of  43  ordinary  Dela- 
ware citizens  called  to  jury  duty  m a po- 
litically sensitive  case.  Many  also  were 
investigated  for  ties  to  the  NAACP. 

► 1960s:  FB!  wiretapped  Martin  Lu- 
ther lung  Jr.  to  gather  damaging  in- 
formation on  extramarital  affairs. 

. *■  1970:  FB!  sent  damaging  informa- 
tion on  NAACP  chief,  Rev.  Ralph  Aber- 
nathy, to  Vice  President  Spiro  Agnew. 

► 19S0s  and  '90s;  FBI  kept  a file  on 
AIDS  activist  group  ACT  UP  and  its 
planned  protests. 

*•1993  and  *94:  Tire  FBI  "inad- 
vertently" released  files  containing  un- 
substantiated allegations  on  numerous 
Republicans  to  low-level  political  ap- 
pointees of  the  Clinton  administration. 


Attorney  General  Janet  RencT  saw  last 
week  that  she  intends  to  begin  a thorough 
review  or  Carnivore.  That’s  a positive  step, 
but  it’s  hard  to  understand  how  Reno 
wouldn't  already  have  a Complete  knowl- 
edge of  the  tool  since  she  is  tire  head  of  the 
"President’s  Working  Group  on  Unlawful 
Conduct  on  the  internet,"  which  just  com- 
pleted its  report  in  March.  V 
The  Clinton  administration  greeted  howls 
about  Carnivore's  reach  with  a proposal  to 
update  electronic-privacy  laws,  although 
congressional  Democrats  say  the  Mil  has  no 
chance  of  even  being  voted  on  this  year. 

The  time  for  such  updating  and  review 
was  before  Carnivore  was  used  Carnivore 
needs  to  be  shut  down  until  an  outside  re- 
view of  its  capabilities  and  safeguards  is 
complete.  And  the  Internet  companies  that 
willingly  complied  with  the  FBI’s  use  of  tire 
technology  in  the  past  need  to  come  forward 
and  inform  individuals  whose  e-mail  the  FBI 
“filtered" 

( Of  course,  taw  enforcement  agendes  can- 
, nor  operate  without  ways  to  monitor  the 
, modem  communications  tools  of  criminals  i 

jaretyonerfreapifority. 

~2>oc 
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£ '!  ^ °f  Hw  innocent  to  be  free  from 

Vi>f  government  intrusion  should  not  be  com-  Visa/ 
promised  to  make  fife  easier  for  tire  FBI  Unt  il 
the  bureau  can  show  that  its  new  technology 
poses  no  threat  to  the  public.  Carnivore 
needs  a starvation  diet. 


Technology  used  narrowly 

Opposing  view:  — — 


By  John  L Colimgwood 

First  lets  get  the  facts  straight.  The  FBI 
and  all  other  law  enforcement  agencies  can 
intercept  e-maiis  only  pursuant  to  a court 
order  signed  by  a judge  who  is  satisfied  t hat 
the  government  has  demonstrated  probable 
cause  that  a serious  crime  Is  being  or  has 
been  committed,  that  the  e-mails  wi  be 
about  that  crime,  and  that  the  interception  is 
necessary  to  obtain  evidence  about  the 
ctime. 

Conducting  an  intercept  beyond  that  is  a 
federal  crime  subject  to  severe  criminal  and 
civil  sanctions.  Hie  entire  process  requires 
continuous  reporting  to  a court  and,  of 
course,  ultimately  is  subject  to  vigorous  chal- 
ky by  defense  attorneys.  Even  when  only 
address  information  is  sought,  a court  order 
is  still  required 

What  does  "Carnivore"  do?  In  the  simplest 
toons,  it  ensures  that  only  the  exact  comma- 
notions  authorized  by  the  court  to  be  in- 
tercepted are  intercepted.  So,  for  example,  If 
a court  authorizes  only  the  interception  of  e~ 


mail  to  the  exclusion  of  all  other  communi- 
cations, regardless  of  whom  send  s them  a nd 
where  they  are  going.  Nothing  else  is  mon- 
itored or  collected,  and  everything  collected 
is  supervised  by  the  court 

When  is  Carnivore  used?  It  is  used  only 
when  m Internet  service  provider  cannot,  on 
its  own,  effect  the  interceptions  consistent 
with  a narrow  court  order.  Accordingly,  it  has 
been  used  very  few  times,  predominately  in 
terrorism  cases. 

In  1968,  Congress  spelled  out ^tricf  re- 
quirements for  imerceptions.  Carnivore  sim- 
ply ensures  that  law  enforcement  agencies 
comply  precisely  with  those  requirements  as 
technology  advances.  We  understand  why  1 
certain  segments  oppose  this  court-super- 
vised technique  But  since  1968,  because  of 
this  law,  many  lives  have  been  saved  and 
thousands  of  drug,  dealers,  terrorists,  child 
predators  and  spies  are  in  jail. 

Hie  chai  rman  of  PSINet  laid  out  the  appro- 
priate challenge  He  does  not  warn  to  see 
Carnivore  on  his  network  unless  vve  can 
prove  It  collects  only  the  traffic  from  the  tar- 
get of  a court  order.  That,  of  course,  is  pre- 
cisely what  Carnivore  - does,  electronically 
protect  the  privacy  of  tho&e  not  subject  to 
the  court  order. 


mail  from  a particular  drug  dealer  to  another  John  £ Coli'mgmod  is  an  assistmtdirectw 

drag  dealer,  thts  system  captures  only  that  e~  of  the  Mem!  Bureau  of  investigation. 
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July  24,  2000 


Mr * Brian  Gal 1 agher 
Editor  of  the  Editorial  Paqe 
U&V  Today 
1000  Wilson  Blvd. 

Arlington,  VA  22229 

Dear  Mr,  Gallagher: 


In  response  to  today's  editorial  about  "Carnivore  " 
again  let's  get  the  facts  correct, 

PSA  Today  rightly  points  out  that  "law  enforcement 
agencies  cannot  operate  without  ways  to  monitor  the  modern 

communications  tools  of  criminals"  but  then  questions  who 

should  ensure  that  privacy  is  properly  protected.  The  simple 
answer  is  the  same  as  it  has  been  for  over  30  years- -federal 
judges  All  of  the  federal  criminal  and  civil  sanctions  Jnd 
juuicial  oversight  that  apply  to  wiretapping  and  have  ef fee- 
lively  protected  those  not  the  target  of  s court  order  apply 
to  the  use  of  Carnivore  to  intercept  the  e-mails  of  criminals 


, Unlike  as  the  editorial  reflects,  howe'ver,  Carnivore 

aoes  not  snoop  through  every  Internet  communication,  does  not 
spit  out  everyone's  e-mail,  and  is  not  an  unrestrained  Internet 
wiretap.  Court  orders  authorising  the  intercept  of  criminals* 
e-mails  come  only  after  rigorous  review  and  the  conclusion 
that  there  is  probable  cause  that  a crime  is  being  or  has  been 
committed,  the  e-mails  are  about  or  in  furtherance  of  that 
cPme  *-ke  intercept  is  necessary  to  gather  evidence  about 
the  crime.  The  orders  are  specific  as  to  whom  and  what  can  be 
intercepted  and  then  the  courts  supervise  the  interception  to 
ensure  compliance.  Evading  those  court  orders  is  aseribus  crime 
which  would,  ot  course,  produce  absolutely  nothing  of  evidentiary 


Finally,  the  editorial  says  the  "Bureau  won't  answer 
even  the  most  basic  questions  about  whom  the  technology  targets 
a ■ how  it  protects  the  privacy  of  innocent  users,"  Contrary  to 


1 - Mr* 


JBC ; mmc 


Pickard 

Kerr 

Parkinson 
Col ling wood 
(8) 
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Mr.  Brian  Gallagher 


that  assertion,  however,  the  FBI  has  shown  the  system  to  and 
answered  these  questions  for  dozens  of  people  on  Capitol  Hill 
and  over  30  reporters  representing  25  media  outlets.  USA  Today, 
of  course,  was  invited  and  today  we  are  anxious  to  present  it 
at  an  open  hearing  before  a congressional  subcommittee.  We  are 
arranging  for  an  independent  review  as  well. 

' Sure  Carnivore  can  be  controversial  and  clearly  is  ill- 

named.  But  it  is  used  only  pursuant  to  court  order;  has  been 
used  sparingly,  predominantly  in  terrorism  cases,  and  then  only 
when  an  Internet  Service  Provider  cannot  on  its  own  comply  with 
the  court  order;  and,  when  used,  collects  only  what  the  law 
authorizes  and  the  courts  instruct  be  collected- -evidence  about 
serious  crime  that  cannot  be  otherwise  gathered. 

Sincerely  yours, 


John  E.  Colli ngwood 
Assistant  Director 
Office  of  Public  and 
Congressional  Affairs 
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Carnivore  might  sound  hu  a 
particularly  violent  computer 
game,  or  perhaps  a movie  that  you 
wouldn't  let  your  t^year-old  go 
see  alone,  It's  actually  a proj- 
ect of  the  FBI  which,  de- 
pending on  your  out* 
look,  is  either  a threat  to  Jflr 
the  privacy  of  all  Aroeri-  Hgsr 

cans  or  a useful  tod  in 
fighting  criminals. 

The  unfortunately  named 
program  (the  FBI  fits  been  trying 
to  come  up  with  something  else 
since  news  of  its  existence 
broke)  is  an  eaves dropping  de- 
vice headed  in  a tangle  of  elec- 
tronics the  size  of  a laptop. 

The  agency  wants  to  deploy  Car- 
nivore boxes  at  the  main  comput* 
ers  of  all  Internet  service  providers, 
to  provide  an  efficient  way  for  the 
FBI  to  conduct  coon-approved 
wiretaps  on  e-mail  in  an  era  when 
all  rommunotion,  lawful  and  oth* 


mvise,  is  going  digital. 

Since  word  of  this  hit  during  con- 
gressional testimony  the  nation's 
privacy  advocates  have  been  out- 
raged at  the  Idea  of  the  Internet  be- 

n|ut  'M  not  just  activists  who  are 
up  in  arms.  So  b the  Republican 
leadership  m<t?r^ess;4feuse-Ma*- 
jority  leader  Dick  Armey  of  Texas 
has  attacked  Carnivore  as  being  il- 
legal under  current  wiretap  law's, 
and  the  Constitution  subcommittee 
of  the  House  judiciary  Committee 
held  hearings  Monday  to  look  into 
the  matter 

Now;  privacy'  advocates  have 


ty  Qw(*>  7^*0,  U4A  T004V 


been  fighting  for  years  to  protea 
our  information  from  prying  eyes. 
But  ifs  fascinating  to  see  everyone 
else  getting  into  such  a lather  over 
a system  that  - unless  die  FBI  is  ly- 
ing through  its  teeth  - is  very  lim- 
ited in  what  if  s allowed  to  do, 
-Tn  ^-perfect*  world.  1 might  be 
concerned  ahoor  the  idea  that  were 
1 the  subject  of  an  investigation,  the 
FBI  could  monitor  my  e-mail  But 
agents  would  at  least  have  to  go  be- 
fore a judge  and  get  permission. 
And  even  at  the  height  of  govern- 
ment surveillance  during  the  Mc- 
Carthy era.  the  number  of  people 


eiife 

By  Elizabeth  Weise 

being  monitored  numbered  weS 
under  1 mtlfoa 

That  pales  in  comparison  wish 
whafs  already  happening  with 
every  keystroke  we  make  as  we 
wander  the  commercial  Web, 

, Many  sites  record  every 
|k  search  made  and  every 
mouse  tkk  buMng  up  a 
defiled  dossier  of  interests 
^ and  surfing  choices,  whkh 
they  use  to  target  the  ads 
that  appear  on  our  screens. 
A fair  number  also  “bug" 
■V  their  sites,  scattering  invisi- 

Jble  cookies  that  our  brows- 
ers pick  up,  allowing  that  site 
and  others  to  share  informa- 
tion to  create  an  even  more 
specific  portrait 

<***  In  addition  by  linking  to 
outside  databases,  It's  pos- 
sible to  attach  that  portrait  to  a 
name,  address  and  personal  data, 
including  what  stores  you  shop  ac 
what  you  buy  and  when  you  pay 
your  bills.  And  let's  not  forget  that  if 
the  company  goes  out  of  business. 


It  can  try  m auction  of  its 
to  the  highest  bidder  - th 
government  we  so  fear  is 
on  making  that  legal 
All  that  t $ bad  enough, 
rntm  compared  with  w 
happen  when  the  Vkh ; 
less  and  we  aH  begin  acc 
e-mail,  bank  accounts  ar 
funds  from  cellphones, 
thought  a cookie  or  two 
trusfre,  wit  till  everyth! 
is  finked  in  real  time  toy 
number  and  exact  pbysi 
tion,  as  cellphones  soon  w 
This  isn't  to  say  C 
shouldn  't  be  carefully  mor 
that  we  should  mist  the 
because  tt  tel is  us  to  A just  < 
dersrand  why  so  many  of 
pie  up  in  arms  over  Cara 
against  passing  any  kind 
protection  for  consumer 
online,  saying  the  industt 
velop  only  if  it's  left  to  sel 
When  it  comes  to  the 
my  personal  tnformatio 
the  government  which  is 
stria  laws,  a whole  lot  roo 
trust  multinational  corpon 
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FBI  defends  e-mail  surveillance  tool 


By  Kevin  Johnson 
USA  TODAY 

WASHIMCTON  ~ Peppered  with 
questions  from  skeptical  lawmak- 
er, tfeBl^d  lovvii  concerns 
Monday  that  its  e-mail  surveillance 
program  known  as  “Carnivore" 
coold  be  used  to  eavesdrop  on  the 
Innocent 

At  a House  judiciary  subommir- 
tee  bearing  that  seemed  to  capture 
ton  the  promise  and  pftfafe  of 
<»w  technology  for  law  enforce- 
ment, Assistant  FBI  Director  Donald 
Kerr  defended  the  program  as  a 
useful  tool  for  agents.  He  said  any 
surveillance  done  with  the  Carni- 
vore program  Is  limited  to  those 
suspects  named  in  court  orders. 
Critics,  including  an  unusual  co- 
alirion  of  conservative  Republicans 
and  aril  liberties  advocates,  have 
complained  that  the  program  could 
he  used  to  do  broad  surveillance. 
Their  fear  stems  from  the  way 


the  FBI  implements  the  tasmet- 
wiretapping  system.  Carnivore 
works  through  a suspect*  inreroet 
service  or widen  such  as  America 
Online,  it  allows  tm*esdgiat0f$  to 
identify  and  view  a suspect's  e~ 
mails  among  aH  e-nuBs  moviiw 
through  the  providers  system, 

Critks  are  concerned  about  giv- 
ing law  enforcement  access  to  the 
e-mails  of  innocent  people  as  well 
as  suspects.  Although  Carnivore 
can  retrieve  any  e-mails,  investtea- 
ton:  are  restricted  to  those  that 
have  been  approved  for  monitcrinH 
by  a judge. 

House  judiciary  Committee 
Charonan  Henry  Hyde,  R®,  said 
the  Carnivore  debate  reflected  an 
ongoing  tension  between  Jaw  en- 
forcement and  individual  rights, 

Tou  on  understand  people’s 
concerns  for  privacy?  There  are 
people  who  are  skeptical  about  this 
culture  of  privacy  and  how  porous 
if  tC  Hyde  told  Kerr  and  other  FBI 


officials  at  the  House  hearing. 

Meanwhile,  fop,  j£  Watts,  R- 
0*%  urged  the  dmon  admfoii- 
smariem  to  suspend  the  Mmm. 
tinder  which  the  FBI  has  Percept- 
ed  e-mails  in  25  probes  over  the 
past  two  years.  No  cases  invohnng  * 
Carrimm  have  come  to  trial, 

justice  Department  officiate  also 
sand  they  are  reviewing  die  pro- 
gram  to  make  sure  that  federal 
agents  have  nor  been  involved  in 
unlawful  eavesdropplr^  Kerr  said 
investigators  involved  in  the  Carni- 
vore program  have  never  been  pro- 
vided Internet  traffic  outside  the 
scope  of  their  probes  : "We  don't  do 
broad  searches  (on  internet  traffic) 
and  surveillance  that  is  not  anther 
need  by  com  orders 

This  year,  the  program  has  been 
used  In  16  cases:  six  criminal 
probes  and  10  nadonal-seeuritY  in-  * 
vesdgatlons. 
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July  25, 2000 


Ms.  Christine  Bertelson 
Editor  of  Editorial/Opimon  Page 
St.  Louis  Post  Dispatch 
900  North  Tucker  Blvd 
St.  Louis,  MO  63101-1099 

Dear  Ms.  Bertelson: 

In  response  to  your  recent  editorial  "Silent  cybercrime  hunting,"  a few  additional 
facts  might  help  your  readers  understand  the  safeguards  and  judicial  oversight  applicable  to  the 
interception  of  e-mail  on  the  Internet. 

As  always  happens,  dangerous  criminals  and  terrorists  use  new  technology  as  fast 
as  anyone  does.  So  now,  instead  of  telephones,  we  increasingly  find  criminals  communicating 
by  e-mail  in  furtherance  of  their  crimes.  We  have  seen  this  in  everything  from  child  pornography 
to  terrorism.  That  is  why  the  FBI  developed  the  Carnivore  program,  a tool  that  permits  surgical 
in  terceptions  in  the  midst  of  the  flood  of  data  on  the  Internet. 


To  use  Carnivore  to  obtain  a criminal's  e-mail,  the  FBI  first  must  successfully 
demonstrate  to  a judge  that  there  is  probable  cause  to  believe  that  a serious  crime  is  being  or  has 
been  committed,  the  e-mails  are  about  or  in  furtherance  of  that  crime,  and  the  interception  is 
necessary  to  gather  evidence  about  the  crime.  It  is  the  same  rigorous  legal  standard  that  applies 
to  the  interception  of  telephone  conversations.  The  same  severe  criminal  and  civil  sanc  tions 
apply  to  any  misuse  as  well,  and  the  whole  process  is  supervised  beginning  to  end.bv  the  federal 
court  issuing  the  order.  Finally,  the  use  of  this  evidence  and  the  method  of  collection  are  always 
subject  to  vigorous  challenge  by  defense  lawyers. 


The  FBI  only  uses  Carnivore  when  an  Internet  Service  Provider  cannot,  on  its 
own,  provide  the  very  limited  information  authorized  by  courts  to  be  intercepted,  e.g„  e-mails  to 
and  from  two  drug  dealers.  That  is  why  it  has  only  been  used  25  times  since  it  was  developed 
and,  in  these  cases,  it  was  used  with  assistance  from  the  Internet  Sendee  Provider. 


1 - Mr.  Pickard 
1 - Dr.  Kerr 
(f)-  Mr.  Parkinson 
1 - Mr,  Collingwood 
JECrmmc  (9) 
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Ms,  Christine  Berteison 


Finally,  Carnivore  does  not  "automatically"  search  for  "key  words  among  all  e~ 
mati  traffic."  It  does  not  search  the  content  of  e-mail  at  all  To  search  as  the  editorial  suggests 
would  be  contrary  to  federal  law,  subject  to  severe  criminal  sanctions  and  produce  nothing  of 
e videntiary  val  ue  because  it  would  contravene  the  parameters  of  the  Fourth  Amendment 
Instead,  Carnivore  ensures  that  law  enforcement  only  gets  those  specific  e-mails  addressed  as 
described  in  the  court’s  order  to  the  complete  exclusion  of  everything  else  on  the  Internet. 

Sincerely  yours. 


John  E.  Coll  logwood 
Assistant  Director 
Office  of  Public  and 
Congressional  Affairs 
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STATEMENT 

OF 

KEVIN  V.  DI  GREGORY 
DEPUTY  ASSISTANT  ATTORNEY  GENERAL 
CRIMINAL  DIVISION 

* 

BEFORE  THE 

SUBCOMMITTEE  ON  THE  CONSTITUTION 
COMMITTEE  ON  THE  JUDICIARY 
UNITED  STATES  HOUSE  OF  REPRESENTATIVES 

CONCERNING 

"CARNIVORE"  AND  THE  FOURTH  AMENDMENT 

PRESENTED  ON 
JULY  24,  2000 
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STATEMENT  OF 
KEVIN  V.  Di  GREGORY 
DEPUTY  ASSISTANT  ATTORNEY  GENERAL 
UNITED  STATES  DEPARTMENT  OF  JUSTICE 
BEFORE  THE  SUBCOMMITTEE  ON  THE  CONSTITUTION 
OF  THE  HOUSE  COMMITTEE  ON  THE  JUDICIARY 

on 

“CARNI  VORE”  AND  THE  FOURTH  AMENDMENT 
July  24, 2000 

Mr.  Chairman  and  Members  of  the  Subcommittee,  thank  you  for  allowing  me  this 
opportunity  to  testily  about  the  law  enforcement  tool  “Carnivore”  and  the  Fourth  Amendment 
On  April  6, 2000, 1 had  the  privilege  of  testifying  before  you  during  a hearing  on  Internet  privacy 
and  the  Fourth  Amendment;  I am  pleased  to  continue  to  participate  in  the  discussion  today  about 
“Carnivore”  and  its  role  in  protecting  individual  privacy  on  the  Internet  from  unwarranted 
governmental  intrusion,  and  about  the  critical  role  the  Department  plays  to  ensure  that  the 
Internet  is  a safe  and  secure  place. 

Privacy  and  Public  Safety 

It  Is  beyond  dispute  that  the  Fourth  Amendment  protects  the  rights  of  Americans  while 
they  work  and  play  on  the  Internet  just  as  it  does  in  the  physical  world.  The  goal  is  a long- 
honored  and  noble  one:  to  preserve  our  privacy  while  protecting  the  safety  of  our  citizen  s.  Our 
founding  fathers  recognized  that  in  order  for  our  democratic  society  to  remain  safe  and  our 
liberty  intact,  law  enforcement  must  have  the  ability  to  investigate,  apprehend  and  prosecute 
people  for  criminal  conduct  At  the  same  time,  however,  our  founding  fathers  held  in  disdain  the 
government’s  disregard  and  abuse  of  privacy  in  England.  The  founders  of  this  nation  adopted  the 
Fourth  Amendment  to  address  the  tension  that  can  at  times  arise  between  privacy  and  public 


5/24/02  Release  - Page  1. 


‘ 1 '•  v?V 

vsf  1 -:.'v 


safety*  Under  the  Fourth  Amendment,  the  government  must  demonstrate  probable  cause  before 
obtaining  a warrant  for  a search,  arrest,  or  other  significant  intrusion  on  privacy. 

Congress  and  the  courts  have  also  recognized  that  lesser  intrusions  on  privacy  should  be 
permitted  under  a less  exacting  threshold.  The  Electronic  Communications  Privacy  Act 

(“EOF A”)  establishes  a three-tier  system  by  which  the  government  can  obtain  stored  information 

( 

from  electronic  communication  service  providers.  In  general,  the  government  needs  a search 
warrant  to  obtain  the  content  of  unretrieved  communications  (like  e-mail),  a court  order  to  obtain 
transactional  records,  and  a subpoena  to  obtain  information  identifying  the  subscriber.  See  l 8 
U.S.C.  §§2701-11. 

In  addition,  in  order  to  obtain  source  and  destination  information  in  real  time,  the 

government  must  obtain  a “trap  and  trace”  or  “pen  register”  court  order  authorizing  the  recording 

of  such  information.  See  18  U.S.C.  3121,  et  seq. 

Because  of  the  privacy  values  it  protects,  the  wiretap  statute,  18  U.S.C.  §§  2510*22, 

♦ 

commonly  known  as  Title  Ilf,  places  a higher  burden  on  the  real-time  Interception  of  oral,  wire 
and  electronic  communications  than  the  Fourth  Amendment  requires.  In  the  absence  of  a 
statutory  exception,  the  government  needs  a court  order  to  wiretap  communications.  To  obtain 
such  an  order,  the  government  must  show  that  normal  investigative  techniques  for  obtaining  the 
information  have  or  are  likely  to  fail  or  are  too  dangerous,  and  that  any  interception  will  be 
conducted  so  as  to  ensure  that  the  intrusion  is  minimized. 

The  safeguards  for  privacy  represented  by  foe  Fourth  Amendment  and  statutory 
restrictions  on  government  access  to  information  do  not  prevent  effective  law  enforcement 
instead,  they  provide  boundaries  for  law  enforcement,  clarifying  what  is  acceptable  evidence 
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gathering  and  what  is  not.  At  the  same  time,  those  who  care  deeply  about  protecting  individual 
privacy  must  also  acknowledge  that  law  enforcement  has  a critical  role  to  play  in  preserving 
privacy.  When  law  enforcement  investigates,  successfully  apprehends  and  prosecutes  a criminal 
who  has  stolen  a citizen’s  personal  information  from  a computer  system,  for  example,  law 
enforcement  is  undeniably  working  to  protect  privacy  and  deter  further  privacy  violations.  The 
same  is  true  when  law  enforcement  apprehends  a hacker  who  compromised  the  financial  records 
of  a bank  customer. 

As  we  move  into  the  2 1 8 century,  we  must  ensure  that  the  needs  of  privacy  and  public 
safety  remain  in  balance  and  are  appropriately  reflected  in  the  new  and  emerging  technologies 
that  are  changing  the  face  of  communications.  Although  the  primary  mission  of  the  Department 
of  Justice  is  law  enforcement,  Attorney  General  Reno  and  the  entire  Department  understand  and 
share  the  legitimate  concerns  of  all  Americans  with  regard  to  personal  privacy.  The  Department 
has  been  and  will  remain  committed  to  protecting  the  privacy  rights  of  individuals.  We  look 
forward  to  working  with  Congress  and  other  concerned  individuals  to  address  these  important 
matters  in  the  months  ahead. 

Law  Enforcement  Tools  in  Cyberspace: 

Although  the  Fourth  Amendment  is  over  two  centuries  old,  fee  Internet  as  we  know  it  is 
still  in  its  infancy.  The  huge  advances  in  the  past  ten  years  have  changed  forever  the  landscape 
of  society,  not  just  in  America,  but  worldwide.  The  Internet  has  resulted  in  new  and  exciting 
ways  for  people  to  communicate,  transfer  information,  engage  in  commerce,  and  expand  their 
educational  opportunities.  These  are  but  a few  of  the  wonderful  benefits  offers  rapidly  changing 
technology.  As  has  been  the  case  with  every  major  technological  advance  in  our  history, 
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however,  we  are  seeing  individuals  and  groups  use  this  technology  to  commit  criminal  acts.  As 
Deputy  Attorney  General  Eric  Holder  told  the  Crime  Subcommittee  of  this  Committee  in 
February,  our  vulnerability  to  computer  crime  is  astonishingly  high  and  threatens  not  only  cur 
financial  well-being  and  oar  privacy,  but  also  this  nation’s  critical  infrastructure. 

Many  of  the  crimes  that  we  confront  everyday  in  the  physical  world  are  beginning  to 

appear  in  the  online  world.  Crimes  like  threats,  extortion,  fraud,  identity  theft,  and  child 

pornography  are  migrating  to  the  Internet,  the  Fourth  Amendment  and  laws  addressing  pri  vacy 

and  public  safety  serve  as  a framework  for  law  enforcement  to  respond  to  this  new  forum  for 

criminal  activity.  If  law  enforcement  fails  properly  to  respect  individual  privacy  in  its 

investigative  techniques,  the  public’s  confidence  in  government  will  be  eroded,  evidence  will  be 

suppressed,  and  criminals  will  elude  successful  prosecution.  If  law  enforcement  Is  too  timid  in 

responding  to  cybercrime,  however,  we  will,  in  effect,  render  cyberspace  a safe  haven  for 

criminals  and  terrorists  to  communicate  and  cany  out  crime,  without  fear  of  authorized 

* 

government  surveillance.  If  we  fail  to  make  the  Internet  safe,  people’s  confidence  in  using  the 
Internet  and  e-commerce  will  decline,  endangering  the  very  benefits  brought  by  the  Information 
Age.  Proper  balance  is  the  key, 

To  satisfy  our  obligations  to  the  public  to  enforce  the  laws  and  preserve  the  safety',  we  use 
the  same  sorts  of  investigative  techniques  and  methods  online  as  we  do  in  the  physical  world, 
with  the  same  careful  attention  to  the  strict  constitutional,  statutory,  internal  and  court-ordered 
boundaries.  Carnivore  is  simply  an  investigative  tool  that  is  used  online  only  under  narrowly 
defined  circumstances,  and  only  when  authorized  by  law,  to  meet  our  responsibilities  to  the 
public. 
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To  illustrate,  iavv  enforcement  often  needs  to  find  out  from  whom  a drug  dealer,  for 
instance,  is  buying  his  illegal  products,  or  to  whom  the  drug  dealer  is  selling.  To  investigate  this, 
it  is  helpful  to  determine  who  is  communicating  with  the  drug  dealer.  In  the  “olden  days”  of 
perhaps  10  years  ago,  the  drag  dealer  would  have  communicated  with  his  supplier  and  customers 
exclusively  through  use  of  telephones  and  pagers.  Law  enforcement  would  obtain  an  order  from 
a court  authori  zing  the  installation  of  a “trap  and  trace”  and  a “pen  register”  device  on  die  drag 
dealer’s  phone  or  pager,  and  either  the  telephone  company  or  law  enforcement  would  have 
installed  these  devices  to  comply  with  the  court’s  order.  Thereafter,  the  source  and  destination  of 
his  phone  calls  would  have  been  recorded.  This  is  information  that  courts  have  held  is  not 
protected  by  any  reasonable  expectation  of  privacy.  Given  the  personal  nature  of  this 
information,  however,  the  law  requires  government  to  obtain  an  order  under  these  circumstances. 
In  this  way,  privacy  is  protected  and  law  enforcement  is  able  to  investigate  to  protect  the  public. 

Now,  that  same  drug  dealer  may  be  just  as  likely  to  send  an  e-mail  as  call  his 

* 

confederates.  When  law  enforcement  uses  a “trap  and  trace”  or  “pen  register”  in  the  online 
context,  however,  we  have  found  that,  at  times,  the  Internet  service  provider  has  been  unable  or 
even  unwilling  to  supply  this  information.  Law  enforcement  cannot  abdicate  its  responsibility  to 
protect  public  safely'  simply  because  technology  has  changed.  Rather,  the  public  rightfully 
expects  that  law  enforcement  will  continue  to  be  effective  as  criminal  activity  migrates  to  the 
Internet  We  cannot  do  this  without  tools  like  Carnivore. 

When  a criminal  uses  e-mail  to  send  a kidnaping  demand,  to  buy  and  sell  illegal  drugs  or 
to  distribute  child  pornography,  law  enforcement  needs  to  know  to  whom  he  is  sending  messages 
and  from  whom  he  receives  them.  To  get  this  information,  we  obtain  a court  order,  which  we 
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serve  on  the  appropriate  service  provider.  Because  of  the  nature  ofintemet  communications,  the 
addressing  information  (which  does  not  include  the  content  of  the  message)  is  often  mixed  in 
with  a lot  of  other  non-content  data  that  we  have  no  desire  to  gather.  If  the  service  provider  can 
comply  with  the  order  and  provide  us  with  only  the  addressing  informatkm  required  by  court 
order,  it  will  do  so  and  we  will  not  employ  Carnivore:  If,  however,  the  service  provider  is 
unwilling  or  unable  to  comply  with  the  order,  we  simply  cannot  give  a criminal  a free  pass.  It  is 
for  that  narro  w set  of  circumstances  that  the  FBI  designed  “Carnivore.” 

Carnivore  is,  in  essence,  a special  filtering  tool  that  can  gather  the  information  authorized 
by  court  order,  and  only  that  information.  It  permits  law  enforcement,  for  example,  to  gather 
only  the  email  addresses  of  those  persons  with  whom  the  drug  dealer  is  communicating,  without 
allowing  any  human  being,  either  from  law  enforcement  or  the  service  provider,  to  view  private 
information  outside  of  the  scope  of  the  court’s  order.  In  other  words,  Carnivore  is  a minimization 
tool  that  permits  lav*'  enforcement  strictly  to  comply  with  court  orders,  strongly  to  protect 
privacy,  and  effectively  to  enforce  the  law  to  protect  the  public  interest.  In  addition,  Carnivore 
creates  an  audit  trail  that  demonstrates  exactly  what  it  is  capturing. 

As  with  any  other  investigative  tools,  there  are  many  mechanisms  we  have  in  place  to 
prevent  against  possible  misuse  of  Carnivore,  and  to  remedy  misuse  that  has  occurred.  The 
Fourth  Amendment,  of  course,  restricts  what  law  enforcement  can  do  with  Carnivore,  as  do  the 
statutory  requirements  of  Title  lU  and  the  Electronic  Communications  Privacy  Act,  and  the 
courts. 

For  federal  Title  III  applications,  the  Department  of  Justice  imposes  its  own  guidelines  on 
top  of  the  privacy  protections  provided  by  the  Constitution,  statutes  and  the  courts  . For  example, 
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before  Carnivore  may  be  used  to  intercept  wire  or  electronic  communications,  the  requesting 
investigative  agency  must  obtain  approval  for  the  Title  III  application  from  the  Department  of 
Justice.  Specifically,  the  Office  of  Enforcement  Operations  (OEO)  in  the  Criminal  Division  of 
the  Department  reviews  each  proposed  Title  IU  application  to  ensure  that  the  interception 
satisfies  the  Fourth  Amendment  requirements,  and  is  in  compliance  with  applicable  statutes  and 
regulations.  Even  if  the  proposal  clears  the  OEO,  approval  must  be  given  by  a Deputy  Assistant 
Attorney  General.  Although  this  requirement  of  high-level  review  is  required  by  Title  HI  only 
with  regard  to  proposed  intercepts  of  wire  and  oral  communications,  the  Department  voluntarily 
imposes  the  same  le  vel  of  re  view  for  proposed  interceptions  of  electronic  communications 
(except  digital-display  pagers).  Typically,  investigative  agencies  such  as  the  Federal  Bureau  of 
Investigation  have  similar  internal  requirements,  separate  and  apart  from  Constitutional,  statutory 
or  Department  of  Justice-  requirements. 

If  the  investigative  agency  and  the  Department  of  Justice  approve  a federal  Title  III 
request,  it  still  must,  of  course,  be  approved  by  the  proper  court  . The  court  will  evaluate  the 
application  under  the  Fourth  Amendment  and  using  the  familiar  standards  of  Title  HI.  By  statute, 
for  example,  the  application  to  the  court  must  show,  through  sworn  affidavit,  why  the  intercept  is 
necessary  as  opposed  to  other  less-intrusive  investigative  techniques.  The  application  must  also 
provide  additional  detail,  including  whether  there  have  been  previous  interceptions  of 
communications  of  the  target,  the  identity  of  the  target  (if  kno  wn),  the  nature  and  l ocation  of  the 
communications  facilities,  and  a description  of  the  type  of  communications  sought  and  the 
offenses  to  which  the  communications  relate.  By  statute  and  internal  Department  regulation,  the 
interception  may  last  no  longer  than  39  days  without  an  extension  by  the  court. 
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Courts  also  often  impose  their  own  requirements.  For  example,  many  federal  courts 
require  that  the  investigators  provide  periodic  reports  setting  Forth  information  such  as  the 
number  of  communications  intercepted,  steps  taken  to  minimize  irrelevant  traffic,  and  whether 
the  interceptions  have  been  fruitful.  The  court  may,  of  course  terminate  the  interception  at  any 
time. 

{ 

The  remedies  for  violating  Title  HI  or  ECPA  by  improperly  intercepting  electronic 
communications  can  include  criminal  sanctions,  civil  suit,  and  for  law  enforcement  agents, 
adverse  employment  action.  For  violations  of  the  Fourth  Amendment,  of  course,  the  remedy  of 
suppression  is  also  available. 

Carnivore  itself  also  contains  self  regulating  features.  For  example,  because  of  its 
sophisticated  passive  filtering  features,  it  automates  the  process  of  minimization  without 
intrusive  monitoring  by  investigators,  and  simply  disregards  packets  of  information  that  do  not 
satisfy  the  criteria  in  the  court’s  authorization.  Indeed,  one  of  the  most  powerful  privacy* 
protecting  features  of  Carnivore  Is  its  ability  to  ignore  information  that  is  outside  the  scope  of  the 
court-ordered  authority  . For  later  verification,  it  also  logs  the  filter  settings.  In  addition,  as  a 
practical  matter.  Carnivore  is  not  deployed  except  with  close  cooperation  with  the  appropriate 
system  provider.  fa  any  event,  thc.FHI  does  not  use  Carnivore  in  every  instance  in  which  the 
court  orders  a Title  IB  electronic  communication  intercept  Indeed,  I understand  that  the  Bureau 
uses  Carnivore  only  in  those  instances  when  the  service  provider  is  unable  to  comply  with  the 
court  order  using  its  own  equipment,  or  when  the  provider  asks  the  FBI  to  use  Bureau  equipment. 

As  I testified  in  April,  we  face  three  major  categories  of  challenges  in  trying  to  keep  the 
Internet  a safe  and  secure  place  for  our  citizens.  These  are: 
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1 . Technical  challenges  that  hamper  law  enforcement’s  ability  to  locate  and 
prosecute  criminals  that  operate  online; 

2.  Certain  substantive  and  procedural  laws  that  have  not  kept  pace  with  the  changing 
technology,  creating  significant  legal  challenges  to  effective  investigation  and 
prosecution  of  crime  in  cyberspace;  and 

3 . Resource  needs  that  must  be  addressed  to  ensure  that  law  enforcement  can  keep 
pace  with  changing  technology  and  has  the  ability  to  hire  and  train  people  to  fight 
cybercrime. 

Carnivore  is  an  investigative  tool  that  assists  us  in  meeting  the  first  challenge.  As  we 
have  witnessed,  tracking  a criminal  online  is  not  always  an  impossible  task  using  our 
investigative  tools.  For  example,  last  year  federal  and  state  law  enforcement  combined  to 
successfully  apprehend  the  creator  of  the  Melissa  virus  and  the  individual  who  created  a 
fraudulent  Bloomberg  News  Service  website  in  order  to  artificially  drive  up  the  stock  price  of 
PairGain,  a telecommunications  company  based  in  California.  Although  we  are  proud  of  these 
important  successes,  we  still  face  significant  challenges  as  online  criminals  become  more  and 
more  sophisticated. 

In  nearly  every  online  case,  tracking  the  •online  criminal  requires  law  enforcement  to 
attempt  to  trace  the  “electronic  trail”  from  the  victim  back  to  the  perpetrator.  In  effect,  this 
“electronic  trail”  is  the  fingerprint  of  the  twenty-first  century  - only  much  harder  to  find  and  not 
as  permanent  as  its  more  traditional  predecessor.  In  the  physical  world,  a criminal  and  his  victim 
are  generally  in  the  same  location.  But  cybercriminals  do  not  have  to  physically  visit  the  crime 
scene.  Instead  they  cloak  their  illegal  activity  by  weaving  communications  through  a series  of 
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anonymous  remailers,  by  creating  forged  e-mail  headers  with  powerful  point  and  click  tools 
readily  downloadable  from  hacker  websites,  by  using  a '‘free-trial"  account  or  two,  or  by  “wiping 
dean"  the  logging  records  that  would  be  evidence  of  their  activity. 

In  some  cases,  the  criminal  may  not  even  be  in  the  same  country  as  the  victim.  The  global 
nature  of  the  internet,  white  one  of  the  greatest  assets  of  the  Internet  to  law-abiding  citizens, 
allows  criminals  to  conduct  their  illegal  activity  from  across  the  globe.  In  these  cases,  the  need 
to  respond  quickly  and  track  the  criminal  is  increasingly  complicated  and  often  frustrated  by  the 
fact  that  the  activity  takes  place  throughout  different  countries.  With  more  than  190  countries 
connected  to  the  Internet,  it  is  easy  to  understand  the  coordination  challenges  that  face  law 
enforcement.  Furthermore,  in  these  cases,  time  is  of  the  essence  and  the  victim  may  not  even 
realize  they  have  been  victimized  until  the  criminal  has  long  since  signed-off.  Clearly,  the 
technical  challenges  for  law  enforcement  are  real  and  profound. 

This  fact  was  made  dear  in  the  findings  and  conclusions  reached  in  the  recently  released 
report  of  the  President’s  Working  Group  on  Unlawful  Conduct  on  the  Internet,  entitled,  “The 
Electronic  Frontier:  The  Challenge  of  Unlawful  Conduct  Involving  the  Use  of  the  Internet.”  This 
extensive  report  highlights  in  detail  the  significant  challenges  facing  law  enforcement  in 
cyberspace.  As  the  report  states,  the  needs  and  challenges  confronting  law  enforcement,  “are 
neither  trivial  nor  theoretical.”  The  Report  outlines  a three-pronged  approach  for  responding  to 
unlawful  activity  on  the  Internet: 

1 , Conduct  on  the  Internet  should  be  treated  in  the  same  manner  as  simitar  conduct 
offline,  in  a technology  neutral  manner. 
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2.  We  must  recognize  that  the  needs  and  challenges  of  law  enforcement  posed  by  the 
Internet  are  substantial,  including  our  need  for  resources,  up-to  date  investigative 
tools  and  enhanced  multi-jurisdictional  cooperation. 

3.  Finally,  we  need  to  foster  continued  support  for  private  sector  leadership  in 
developing  tools  and  methods  to  help  Internet  users  to  prevent  and  minimize  the 
risks  of  unlawful  conduct  online. 

I would  encourage  anyone  with  an  interest  in  tins  important  topic  to  review  carefully  the 
report  of  the  Working  Group.  The  report  can  be  found  on  the  Internet  by  visiting  the  website  of 
the  Department  of  Justice’s  Computer  Crime  and  Intellectual  Property  Section,  located  at 
www.evbemrime.gov.  In  addition  to  the  report,  ww.eybercrime.gov  also  contains  other  useful 
information  on  a wide  array  of  Internet  related  issues,  including  the  topic  of  today’s  hearing  - 
privacy. 

Despite  the  type  of  difficulties  outlined  in  the  Unlawful  Conduct  Report  and  discussed 

♦ 

today,  the  Justice  Department  and  law  enforcement  across  this  nation  are  committed  to 
continuing  to  work  together  and  with  their  counterparts  in  other  countries  to  develop  and 
implement  investigative  strategies  to  successfully  track,  apprehend,  and  prosecute  individuals 
who  conduct  criminal  activity  on  the  Internet,  In  so  doing,  the  same  privacy  standards  that  apply 
in  the  physical  world  remain  effective  online. 

Mr.  Chairman,  the  Department  of  Justice  has  taken  a proactive  leadership  role  in  making 
cyberspace  safer  for  all  Americans.  The  cornerstone  of  our  cybercrime  prosecutor  program  is  the 
Criminal  Division’s  Computer  Crime  and  Intellectual  Property  Section,  known  as  COPS. 

CCIPS  was  founded  in  1991  as  the  Computer  Crime  Unit,  and  became  a Section  in  1996.  COPS 
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has  grown  from  five  attorneys  in  1996  to  nineteen  today,  and  we  need  more  to  keep  pace  with  the 
demand  for  their  expertise.  The  attorneys  in  GCIPS  work  closely  on  computer  crime  cases  with 
Assistant  United  States  Attorneys  known  as  “Computer  and  Telecommunications  Coordinators,” 
or  CTC’s,  in  U.S.  Attorney’s  Offices  around  the  nation.  Each  CTC  receives  special  training  and 
equipment  and  serves  as  the  district’s  expert  on  computer  crime  cases.  CCIPS  and  the  CTC’s 
work  together  in  prosecuting  cases,  spearheading  training  for  local,  state  and  federal  law 
enforcement,  working  with  international  counterparts  to  address  difficult  international 
challenges,  and  providing  legal  and  technical  instruction  to  assist  in  the  protection  of  this 
nation’s  critical  infrastructures.  We  are  very  proud  of  the  work  these  people  do  and  we  will 
continue  to  work  diligently  to  help  stop  criminals  from  victimizing  people  online. 

I also  note  that  public  education  is  an  important  component  of  the  Attorney  General’s 
strategy  on  combating  computer  crime.  As  she  often  notes,  the  same  children  who  recognize  that 
it  is  wrong  to  steal  a neighbor’s  mail  or  shoplift  do  not  seem  to  understand  that  it  is  equally 

K 

wrong  to  steal  a neighbor’s  e-mail  or  copy  a proprietary  software  or  music  file  without  paying  for 
it.  To  remedy  this  problem,  the  Department  of  Justice,  together  with  the  Information  Technology 
Association  of  America  (ITAA)  , has  embarked  upon  a national  campaign  to  educate  and  raise 
awareness  of  computer  responsibility  and  to  provide  resources  to  empower  concerned  citizens. 

.*  4 4* 

The  "Cybercitizen  Awareness  Program”  seeks  to  engage  children,  young  adults,  and  others  on 
the  basics  of  critical  information  protection  and  security  and  on  the  limits  of  acceptable  online 
behavior.  The  objectives  of  the  program  are  to  give  children  an  understanding  of  cyberspace 
benefits  and  responsibilities,  an  awareness  of  consequences  resulting  from  the  misuse  of  the 
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medium  and  an  understanding  of  the  persona!  dangers  that  exist  on  the  Internet  and  techniques  to 
avoid  being  harmed. 

Finally,  Mr.  Chairman,  the  Subcommittee  may  be  aware  that  the  Administration  will  soon 
be  transmitting  to  Congress  a legislative  proposal  addressing  various  issues  relating  toxyber- 
security.  I know  that  fee  focus  of  today's  hearing  is  the  Carnivore  program,  and  this  is  not  the 
time  to  undertake  any  detailed  discussion  of  the  Administration's  proposal.  I would,  however, 
like  to  mention  two  points  that  relate  directly  to  today's  discussion.  First,  fee  Administration 
supports  raising  the  statutory  standards  for  intercepting  the  content  of  electronic  communications 
so  they  are  fee  same  as  those  for  intercepting  telephone  calls:  high-level  approval,  use  only  in 
cases  involving  certain  predicate  offenses  that  are  specified  by  statute,  and  statutory  suppression 
of  evidence  derived  from  improper  intercepts,  Second,  the  Administration  supports  requiring 
federal  judges  to  confirm  that  the  appropriate  statutory  predicates  have  been  satisfied  before 
issuing  a pen  register  or  trap-and-trace  order.  Those  changes  would  apply  to  the  use  of  Carnivore 
- and  would,  in  important  respects,  simply  confirm  by  statute  fee  policies  and  procedures  already 
followed  by  the  Department  of  Justice.  Beyond  those  specific  points,  I will  simply  note  here  that 
fee  Administration  supports  a balanced  updating  of  laws  to  enhance  protection  of  both  privacy 
and  public  safety,  and  that  the  forthcoming  proposal  will  contain  important  provisions  whose 
enactment  would  be  most  helpful  in  the  ongoing  fight  against  cyber-crime. 


■m 


Mr.  Chairman,  I want  to  thank  you  again  for  this  opportunity  to  testify  today  about  our 
efforts  to  fight  crime  on  the  Interact  while  preserving  fee  rights  conferred  by  the  Fourth 
Amendment  and  statute.  Ultimately,  the  decision  as  to  the  appropriate  parameters  of  law 
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enforcement  activity  lies  squarely  within  the  Constitution  and  the  elected  representatives  of  the 
people,  the  Congress.  The  need  to  protect  the  privacy  of  the  American  people,  not  just  from  the 
government  hut  also  from  criminals,  is  a paramount  consideration,  not  just  in  the  context  of  the 
Internet,  but  in  general.  The  Department  of  Justice  stands  ready  to  work  with  this  Subcommittee 
and  others  to  achieve  the  proper  balance  between  the  important  need  for  protecting  privacy  and 
the  need  to  respond  to  the  growing  threat  of  crime  in  cyberspace. 

Mr.  Chairman,  that  concludes  my  prepared  statement.  I would  be  pleased  to  attempt  to 
answer  any  questions  that  you  may  have  at  this  time. 
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Oral  Statement  of  Kevin  Bi  Gregory 

Mr.  Chairman,  and  Members  of  the  Subcommittee,  thank  you  for  allowing  me  this 
opportunity  to  testify  about  the  law  enforcement  tool  “Carnivore”  and  the  Fourth  Amendment. 

We  have  seen  magnificent  growth  of  the  internet  over  the  iast  ten  years.  It  has  created 

vast  benefits  for  citizens,  businesses  and  governments,  and  seems  to  hold  boundless  promise  If  we 

( 

can  harness  it.  The  Internet  has  spurred  a new  and  thriving  economy.  Many  businesses  have 

prospered  by  providing  their  products  and  services  through  the  Internet.  Others  have  assisted  in 

building,  maintaining  and  improving  the  Internet  itself.  The  Internet  has  given  people  jobs, 

supported  families  and  communities  and  created  new  opportunities  for  commerce  for  America  and 

the  world.  The  Internet  has  touched  both  oar  working  lives  and  our  family  lives. 

As  we  have  seen  throughout  histoiy,  however,  there  are  those  who  use  the  powerful  tools 

of  progress  to  inflict  harm  on  others.  The  Internet  has  not  escaped  this  historical  truth.  Even  in 

the  internet’s  relatively  short  existence  we  have  seen  a wide  range  of  criminal  use  of  the 

* 

technology.  It  has  been  used  to  commit  traditional  crimes  against  an  ever  widening  number  of 
victims.  There  are  aiso  those  criminals  intent  on  attacking  and  disrupting  computers,  computer 
networks  and  the  Internet  itself.  In  short,  although  the  Internet  provides  an  unparalleled 
opportunities  for  Americans  to  freely  express  ideas,  it  also  provides  a very  effective  means  for 
ill-motivated  persons  to  breach  the  privacy  and  security  of  others. 

Many  of  the  crimes  that  we  confront  everyday  in  the  physical  world  are  beginning  to 
appear  in  the  online  world.  Crimes  like  threats,  extortion,  fraud,  identity  theft,  and  child 
pornography  are  migrating  to  the  Internet.  The  Fourth  Amendment  and  laws  addressing  privacy 
and  public  safety  serve  as  a framework  for  law  enforcement  to  respond  to  this  new  forum  for 
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criminal  activity  . If  law  enforcement  fails  properly  to  respect  individual  privacy  in  its  investigative 
techniques,  the  public's  confidence  in  government  will  be  eroded,  evidence  will  be  suppressed, 
and  criminals  will  dude  successful  prosecution.  If  law  enforcement  is  too  timid  in  responding  to 
cybercrime,  however,  we  will,  in  effect,  render  cyberspace  a safe  haven  for  criminals  and  terrorists 
to  communicate  and  carry  out  crime,  without  fear  of  authorized  government  surveillance.  If  we 
fall  to  make  the  Internet  safe,  people’s  confidence  in  using  the  Internet  and  e-commerce  will 
decline,  endangering  the  very  benefits  brought  by  the  Information  Age.  Proper  balance  is  the  key. 


Despite  the  fervor  over  the  unfortunately-named  “Carnivore,”  the  truth  of  the  matter  is 
that  Carnivore  is  in  reality  a tool  that  helps  us  achieve  this  balance.  To  satisfy  our  obligations  to 
the  public  to  enforce  the  laws  and  preserve  public  safety,  we  use  the  same  sorts  of  investigatory 
techniques  and  methods  online  as  we  do  in  the  physical  world,  with  the  same  careful  attention  to 
the  strict  constitutional  and  legal  limits.  Carnivore  is  simply  an  investigatory  tool  that  helps  us  to 
investigate  online  in  the  same  way  as  in  the  physical  world,  and  enables  us  to  obtain  only  the 
information  we  are  authorized  to  obtain  through  a court  order. 

To  illustrate,  law  enforcement  often  needs  to  find  out  from  whom  a drug  dealer,  for 
instance,  is  buying  bis  illegal  products,  or  to  whom  the  drug  dealer  is  selling  his  goods.  It  is 
therefore  important  to  determine  with  whom  the  drug  dealer  is  communicating.  In  the  “olden 
days”  of  perhaps  10  years  ago,  the  drug  dealer  would  have  communicated  with  his  supplier  and 
customers  exclusively  through  use  of  telephones  and  pagers.  Law  enforcement  would  obtain  an 
order  from  a court  authorizing  the  installation  of  a “trap  and  trace”  and  a “pen  register”  device  on 
the  drug  dealer’s  phone  or  pager.  Now,  that  same  drug  dealer,  or  a kidnapper  or  a child 
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porno  grapher,  may  be  just  as  likely  to  send  an  e-mail  as  to  call  his  confederates  . 

When  law  enforcement  uses  a “trap  and  trace”  or  “pen  register”  in  the  online  context, 
however,  we  have  found  that,  at  times,  the  Internet  service  provider  has  been  unable  or  even 
unwilling  to  supply  this  information.  It  is  for  that  narrow  set  of  circumstances  that  the  FBI 
designed  “Carnivore.”  Law  enforcement  cannot  abdicate  its  responsibility  to  protect  public  safety 
simply  because  technology  has  changed.  Rather,  the  public  rightfully  expects  that  law 
enforcement  will  continue  to  be  effective  as  criminal  activity  migrates  to  the  Internet  We  cannot 
do  this  without  tools  like  Carnivore. 

Carnivore  is,  in  essence,  a special  filtering  tool  that  can  gather  the  information  authorized 
by  court  order,  and  only  that  information.  It  permits  law  enforcement,  for  example,  to  gather 
pursuant  to  an  order  only  the  email  addresses  of  those  persons  with  whom  the  drug  dealer  is 
communicating,  without  allowing  any  human  being,  either  from  law  enforcement  or  the  service 
provider,  to  view  private  information  outside  of  the  scope  of  the  court’s  order.  In  other  W'ords, 

protect  privacy,  and  to  enforce  the  law  to  protect  the  public  interest,  In  addition,  Carnivore 
creates  an  audit  trail  that  demonstrates  exactly  what  it  is  capturing. 

And  as  with  any  other  investigative  tools,  there  are  many  mechanisms  we  have  in  place  to 
prevent  possible  misuse  of  Carnivore,  and  to  remedy  misuse  that  has  o ccurred.  The  Fourth 
Amendment  and  the  courts,  of  course,  restricts  what  law  enforcement  can  do  on  line,  with  or 
without  Carnivore,  as  do  the  statutory  requirements  of  Title  III  and  the  Electronic 
Communications  Privacy  Act 

In  the  case  of  federal  Title  III  applications,  foe  Department  of  Justice  imposes  its  own 
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guidelines  on  top  of  the  privacy  protections  provided  by  the  Constitution,  statutes  and  the  courts. 
For  example,  before  Carnivore  may  be  used  to  intercept  wire  or  electronic  communications,  with 
the  limited  exception  of  digital  display  pagers,  the  requesting  investigatory  agency  must  obtain 
approval  for  the  Title  HI  application  from  the  Department  of  Justice.  Specifically,  the  Office  of 
Enforcement  Operations  in  the  Criminal  Division  of  the  Department  reviews  each  proposed  Title 
HI  application  to  ensure  that  foe  interception  satisfies  foe  Fourth  Amendment  requirements,  and  is 
in  compliance  with  applicable  statutes  and  regulations.  If  the  proposal  clears  foe  OEO,  appro  val 
must  generally  be  given  by  a Deputy  Assistant  Attorney  GeneisL  Typically,  investigative  agencies 
such  as  the  Federal  Bureau  of  Investigation  have  similar  but  separate  internal  requirements. 

If  the  investigative  agency  and  the  Department  of  Justice  approve  a federal  Title  HI 
request,  it  still  must,  of  course,  be  approved  by  the  proper  court  using  familiar  but  exacting 
standards.  By  statute  and  internal  Department  regulation,  foe  interception  may  last  no  longer 
than  30  days  without  an  extension  by  foe  court.  And  courts  also  often  impose  their  own 
additional  requirements. 

In  addition,  the  remedies  for  violating  Title  IH  or  ECPA  by  improperly  intercepting 
electronic  communi  cations  include  criminal  sanctions  and  civil  suits.  For  violations  of  foe  Fourth 
Amendment,  of  course,  the  remedy  of  suppression  is  also  available. 

Despite  this  panoply  of  protections,  we  recognise  that  concerns  remain  about  this  tool. 
Therefore,  the  Attorney  General  has  asked  for  an  independent  review  of  foe  Carnivore  source 
code  to  ensure  that  its  capabilities  are  what  we  understand  them  to  be.  A report  generated  from 
foe  review  will  be  publicly  disseminated  to  interested  groups  within  industry,  academia  and 
elsewhere,  and  should  alleviate  any  concerns  regarding  unjustified  intrusions  on  privacy  from  foe 
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use  of  this  tool 


Committee  with  my  full  written  statement  It  is  my  sincere  hope  and  expectation  that  through  this 

Softer  to,  there  of«who  are  concerned  about  ?riveey»d  public  ^wtllreeogmee  to 

responsible  law  enforcement  can  enhance  both  goals. 
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Miiimm  of  Americans  now  tog  on  to  the  inter- 
net  as  naturally  and  as  frequently  as  they  pick  up  a 
phone.  Technology  has  created  a revolution  in  per- 
sonal communications,  but  technology  is  also  mak- 
ing it  possible  lor  government  and  even  employers 
to  monitor  private  conversations  as  never  before 
Telephones  laws  must  be  updated  to  address 
those  new  challenges  to  privacy. 

; Last  week  the  White  House  proposed  some 
limited  changes  to  the  federal  wiretap  and  electron- 
ic privacy  laws  that  would  raise  legal  standards  for 
government  interception  of  e-mail.  Separately,  sev- 
eral lawmakers  Introduced  legislation  to  require 
employers  to  notify  employees  about  how  e-mail, 
Internet  use  and  phone  calls  are  monitored  Em- 
ployees of  The  New  York  Times  Company  are 
already  notified  that  the  company  reserves  the 
right  to  review  e-mail  messages  while  investigating 
a complaint.  Last  year  the  company  dismissed  23 
employees  - most  based  at  a regional  business 
office  — for  sending  offensive  e-mail  messages. 

■ in  the  absence  of  more  stringent  controls,  law 
enforcement  agencies  may  be  tempted  to  conduct 
wholesale  monitoring  of  digital  written  communica- 
tions. It  is  probably  not  practical  for  agents  to  listen 
m on  all  the  phone  calls,  for  example,  that  to 
through  AT&T.  But  new  technology  is  making  it 
possible  for  agencies  like  the  F.BJ.  to  scan,  read 
and  record  millions  of  pieces  of  e-mail  on  the 
network  of  an  Internet  service  provider.  Until  now, 
this  kind  of  power  and  its  potential  for  abuse  were 
not  so  readily  available. 

Current  wiretapping  laws  were  not  drafted 
with  this  technology  in  mind  and  need  to  be  updated. 

V ariaus  statutes  now  set  different  legal  standards 
for  the  secret  interception  of  domestic  communica- 
ttons  by  law  enforcement  agencies,  depending  on 
whether  the  communication  is  by  telephone,  e-mail 
or  cable  modem. 

The  Clinton  administration  is  proposing  to 


eliminate  these  inconsistencies.  Its  plan  would  bring 
the  standards  used  for  intercepting  e*maii  mes- 
sages up  to  the  stricter,  more  protective  ievei  now 
applied  to  telephone  wiretaps.  Illegal  interception  of 
e*maii  would  result  in  suppression  of  the  evidence 
as  ts  the  case  now  with  illegal  interception  or  phone 
caiis.  The  proposal  would' also  enforce  the  same 
legal  standards  that  apply  to  phone  calls  for  inter- 
ception of  e-mails  sent  by  cable  modems,  which 
have  a greater  degree  of  privacy  protection  under  a 
law  that  governs  cable  systems. 

The  administration  is  also  calling  for  greater 
authority  for  courts  to  review  law  enforcement 
requests  to  use  devices  that  record  the  phone  num- 
bers of  incoming  and  outgoing  calls  and  to  track  the 
origins  and  destinations  of  e-mail  messages. 

These  changes  are  clearly  needed.  But  Con- 
gress also  needs  to  provide  new  safeguards  against 
the  government's  wrongful  use  of  ever  more  power- 
ful surveillance  technology  against  law-abiding  citi- 
zms*  Serious  concerns  have  been  raised  about  Car- 
iitvort\  the  new  online  wiretap  system  used  by  the 
F.BX  to  track  the  communications  of  individuals 
suspected  of  criminal  activity. 

^ says  the  technology  can  isolate  the  e- 
tnail  of  the  target  of  an  investigation.  But  the 
system,  when  hooked  up  to  the  network  of  the 
internet  service  provider,  gives  die  3P\B,i  unlimited 
access  to  the  e-mail  of  all  other  subscribers  on  the 
network.  While  a court  order  is  still  required  to 
intercept  ihe  content  of  messages,  the  secret  tech- 
nolQgy  controlled  exclusively  by  law  enforcement 
raises  fears  of  Improper  monitoring. 

Until  now,  routine  government  surveillance  of 
private  conversations  was  limited  as  much  by  prac- 
ticahty  as  by  legal  constraints.  Now  that  it  is 
f easible  to  eavesdrop  electronically  on  an  unlimited 
scale,  the  laws  have  to  be  strengthened  to  prevent 
monitoring  of  all  online  communications  simply 
because  technology  makes  it  easy* 
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'The  warning  from  Colombia’s  Serrano 


I ince.the  United  States  approved  £U  billion 
i » «wntemarcotics  aid  for  Colombia,  guer- 

[ ^5?Sh0.prafit  *“»  «»  trade 
*'  & bloody  toTOF  CBlttratum  irs  r»«rn-e ms+ 


What  the  ELN  did  want  to  discuss  is  the  1300 
square-mile  territory  that  Colombian  President 
^^Pastrara^tentebv’ely  agreed  to  surren- 

to  implement  since  the  area,  which  is  rich  in  o2 

ffrtln  flon y'Arwtwrt  t uv.  - * 


continued  unabateZ  m U>lomtJia 

Since  January’,  when  aid  to  Colombia  was 
approve^  the  Revolutionary  Armed  jFbrees  of 

a Suerrafe  group,  has  attacked 
aimost 200 police  stations  and  killed  more  than  100 


™ «wuuun»  iysai  r&su&ntsm  stronglyopposed 
to  forfeiting  the  region  to  the  ELN,  since  they  fear 
hvmg  outside  of  the  government^  protection.  The 

I^OYCTJTXn&lt  £3VS  tb©  C/vnfml  nf  a rinmJJi+A 


uivt  n *****  juacas  mountains 

ppesrs  to  have  resulted  in  the  deaths  of  60  mem 

hers  fifth  a MaffrMi  r * ^ ■ 


In  addition,  on  Monday  200  FARC  terrorists 
ambushed  a police  station  in  the  remote  south- 
western prow^  of  Narrno,  which  is  rich  in  opium 
poppy  holds.  The  FARC  gunned  down  U police 
officers  and  wounded  17  others. 

This  siimtrnt^  context  of  violence  highlights 
how  brutal  guerriliaand  paramilitary  tactics  con - 
Umie  to  be.  Commanders  fertile  FARC,  which  has 
effeem^e  control  of  about  40  percent  of  the  cotin- 
try,  declined  even  to  attend  die  summit  But  die  rob 
attves  ofllpeopie  Iddnapped  by  foe  Em  in  the 
, praig  of  19^  were  there,  lobbying  for  the  release 
of  their  loved  ones.  The  ELK’S  chief,  Antonio  Gar- 
cia  ga^-e  them  little  hope,  pre-empting  the  summit 
01  saywig  that  neither  the  issue  of  hostages  nor  a 
cease-fire  would  be  on  the  table  for  discussion 


* aD°a  one  year  ago  and  an  ombudsman 

appointed  by  Congress  has  documented  41  disap- 
pearances in  the  territory  at  the  hands  of  the 
r ARC.  The  territory  was  ceded  asaland  for  peace 
deal,  but  the  FARC  now  uses  the  demiUtarized  mm 
asa  base  of  illegal  operations  and  has shown  no  will 
Whatsoever  to  negotiate  a peace.  ■ 

Former  Colombian  Police  Chief  Jose  Serrano 
v*o  was  in  Washington  last  week  to  receive  tiie 
D Em  special  agent«ward,  described  the  growing 
Wvg^mOa  and  paramilitary  groups  have  formed 
with  drug  traffickers,  giving  terrorists  access  to 
Vast  resources  to  buy  guns.  ‘After  the  iron  curtain 
fell,  and  subversives  stopped  receiving  money 
from  the  former  Soviet  Union  or  Cuba,  the  FARC 
began  attacking  us  whan  we  fomigated  fcoca] 
crops,  Mr.  Serrano  told  The  Washington  Times! 
Mr.  Pastrana  s plan  to  achieve  peace  through  coun- 
tornarooap  initiatives  and  social  projects  is  there- 
fore  khe  last  chance  that  we  Colombians  have. 
Because  if  it  fails,  we  will  have  to  make  our  peace 
wer  corpses;*  he  said.  No  one  should  want  that 
Colombia  has  seen  enough  suffering. 


<? 
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Who  Needs  Big  Brother 
When  There’s  ‘Carnivore’? 


* emoreement:  The  FBI 
should  not  be  granted  such 
sweeping  powers  to  search  our 
e-mail  and  then  be  trusted  to 
police  itself. 


^bartkosko  

Now  the  FBI  wants  to  recruit  Internet 
service  providers,  or  ISPs,  to  spy  on  U.S. 

raj  already  WOf^’wth  the 
credit  companies  ta  secretly  snoop  or 

p*w  tKsfi  fe  ****  €wtt  “P*«* 
Act  tL  pwi”  *8isewe  Authorisation 
Act  The  FBI  has  installed  digital  phone- 
tappmg  equipment  directly  in  phone  com- 
panies under  a similar  congressional  act 
passed  m 3394.  And  the  Treasury  Depart* 
Enforcement 

•\e.work  has  deputised"  all  banks  to 
monitor  our  bank  accounts  and  to  se- 
cretiy  foe  "suspicious  activity  reports" 
that  n shares  with  the  FBI  and  IRS  and 
even  with  some  foreign  governments. 

The  FBI  calls  its  new  IS?  surveillance 
?;Z3r*  Owjwt-  An  agent  connects 
a Iap.op  to  the  ISP  server  and  then  reads 
at  least  the  address  of  every  e-mail  mes- 
sage that  passes  through  the  server.  The 
FBI  says  ft  has  used  its  Carnivore  soft* 
ware  limes  in  the  last  two  years  to 
search  for  terrorists  or  drug  dealers  or 
71,6  Fm  that 

it  Deeds  this  search-'em^U  software  to 

tfL  fJ  ^ catch  such  criminals 
when  they  use  the  Internet. 

There  are  three  problems  with  Carni- 
vore^ and  each  is  fatal,  The  first  is  that 
Carnivore  undermines  the  4th  Amend- 
ment & ban  m unreasonable  searches— if 
it  does  not  violate  it  outright.  The  FBI 
ffi  a Wge  to  issuer  search 

warrant  based  on  ""probable  ciuse^  This 

me3n  m ******  l^n  that 
ibe  FBI  asks  for  the  warrant  But  the  4th 
Amendment  further  demands  that  the 

***?*  specific —^particulariy  de- 

scribing  the  place  to  be  searched,” 

Carnivore  searches  blindly  thresh  all 
private  e-mails  that  flow  through  the  ISP 
server  while  it  looks  for  a suspicious  few. 

1 ff  m police  have  a warrant  to 
search  someone's  bedroom  dose!  and 
a]i  houses  m a city  until  they 
imd  i t The  search  itself  invades  privacy 
Carnivore  switches  the  order  of  search 

Td  washes 

liret  identify  the  subject's  property 
w'hich  is  then  searched.  Carnivore 
parches  through  private  databases  until 
(t  identifies  a suspect's  property-and 


This  is  a bjg  leap  down  the  slippery 
slope  of  state  invasion  of  privacy.  And 
exJstence  of  web  a monitoring 
S??aces  3 chi!'‘ng  e»e«  on  l 
bec«iS«  toeing 

tort  !,« Ir  po!tce  *%mcy  tead  at 

SS5SS,TSSC”"*"“U 

doS’nnST™^  i$  thM  the  FBI 
o^s  not  need  Carnivore  to  search  for  al- 
leged criminal  e-mails.  Rep,  je^n 
£*?***•  fB-Mich.)  raised  this  Issue 
S/®  Assistant  Director  Donald  Kerr 

K<;7  before  Congress  at  a 

hearing  Monday  on  Carnivore:  “Why  do 

^‘Zlhi0  le,rm'nais  on  at  the 
JbPs  rather  than  Jet  the  ISP  itself  tarn 

deleft*  much  m the  way 

in  at  telephone  camps  n ies  do?'* 

f.  5eT  lfli$  P0‘nt  but  claimed 

H**  1 j|  aht!  needs  Carnivore  for 

Thr?J^S  ,thal  !act:  filtcrtng  software. 

I he,  is  plainly  specious:  The  FBI  or  over- 

^ht  sources  could  simply  give  such  ISPs 
tbu  fiitermg  software.  There  is  simply  no 
need  to  grant  the  FBI  such  sweeping 

?arCh  31,(3  thfin  trust  the 
0 police  itself  as  those  powers  in- 
evitably grow  in  time. 

tiMB!.tbir<?,fob!em  * t!»t  Carnivore  ul- 

costs  Th?  ■ *?V°rk  aesPRe  a!1  its 
costs.  The  criminals  it  tries  to  watch  are 

‘^*7  ^Pfe  **«*  will  take  the  two  oh- 
thJir  f!PS  ev1de  it;  change 

th^v  ifu  * *sita  1Ds  more  °ften,  and 
tne>  m j use  ever  more  powerful  dimlai 
encryption  to  scramble  their  messages 

nPrfn^irreS  ^°,f£war®  blueprints  and 
”fe,^ujrks  themselves  will  leak 
‘°  be  digital  underground  despite  or  be- 

**“*?  °f,lhe.b5st  efiorts  of  those  in  Con- 
gress, or  the  judiciary  who  oversee  it  And 

Stem  a^'1  V **  the  «»*** 

system  and  maybe  crack  g,  ■*:■■■>  . v • 

The  only  people  Carnivore  can  confi- 
dently watch  are  the  innocent  citisens 
whom  it  has  no  right  to  watch.  Th£a£“ 
foohsh  and  dangerous  precedent  for  the 
type  of  heavy-handed  government  sor 

Kssscr  “W  w r«  “ 
?Z3i2^&JS2!TJr 


UnJ'Zri'  ^ wBswiiuonai  limits 
**”*  ^ ingress  should 


*?JiA?sk<>  wepro/essor  of  electrical 
"TSh?*s\tng  on(f  the  oathor  of 

mt>  v *” (RaTidam  HoZ 


•-'5 
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Microsoft  Fd&  Brief Ashing  Supreme  CourttoSm 

=^*22^!*^ 


By  STEVE  LOHR 

In  a legal  document  filed  yester- 
Wfcewwft  argued  that  the  guv* 
ernme/>t  s antitrust  case  is  "0001. 
pleteiyunmitabie  for  direct  appeal" 
to  the  Supreme  Court  because  it  is 
complex  and  because  the  trial  judge 
• ,tnade  serious  and  substantive  pro- 
cedural errors."  * 

HrlfTruK^  itS  «*N  tO  SO 
^rst  to  the  federal  appeals  court  in 

Washington,  which  ruled  in  favor  of 
thecompatiy  in  a related  case 

' v.-ith>LCTPaarS  "*"««"«.  filed 
wtth  the  supreme  Court,  rests  beav- 

‘7  **  * scathing  attack  on  the  work 
of  Judge  Thomas  Penfieid  Jackson 
who  heard  the  lawsuit  in  Federal 
District  Court.  « federal 

The  Microsoft  document,  citing  in- 

S JU<,gC  Jatkson  granted  to 
new  organizations,  including  The 

stated,  "The  dis- 
^ cotm  s Blunt  comments  to  the 
questions  about 

impartiality.*' 

5 \ U(fls  fce  company  to 

Sr”  Case-  **>«.  after  ll 
tensing  the  additional  evitien?* 

th3l$hii%CkTn  assured  «»  company 
*e  more  W0Uici  Based  on 

oriSinal  complaint, 
according  to  the  Microsoft  Him*. 

sutedS“rlitS;rUraf!Ce5'<  ^ company 

?emk£"  ctcom  ^ 

vearth«i*CkS°“  ni!e<J  *«iier  this 
k i Mlcrosoft  was  a monopolist 

he  S>sheK^S5rp^sder 

^ «p  to  might 

l ^56  government  is  seeking 
Bave  the  Supreme  cLJ?T  8 to 
appeal dtreciiva^f ttrt  Bear  the 
By  a federMS^P^eview 
appeals  to  the  coSt^t  C0Urt*  Dir«« 
owjor  antitrust 


fovornment.  F<w  * b(h^l  i>ytSw 


*°,f  £%?*'■ fTmti  a»«»tte  conn. 
oemuarfAru8’  BBcrosoft  is  trying  to 
persuade  the  court  that  the  ap^ai 
will  involve  a thicket  of  tecfEt 
fesues,  procedural  challenges  smt 

SSffiZ** f swiwdK^S 

sa>7-  wiihtnvoive  por- 
ment  had  no  comment  yesterday. 

The  software 
company  says  the 

trial  judge  made 
procedural  errors . 


a krief  saying 

g^fwwanwu  "will  respond  if 

whaf.K?8^  h Bttie  mystery  about 
*"**  w government's  theme  wilt 
y ^ when  if  files  its  brief 
W«h  the  court  on  Aug.  15.  First,  ac- 

lega!  ***»«*.  fB*  govem- 
metrt  wdl  say  that  the  factual  find- 
ings are  clear  and  that  the  issues  for 
appeal  are  * couple  of  big  legal  rjues- 
ons  - precise!)-  the  kind  of  maior 
judgments  of  law  that  the  court  so 
wm  reserves  for  itself, 

whww  i!?gaJ  “•  say> are 
whether  Microsoft's  bundling  of  its 

internet  browser  with  its  todustrY- 

cPem*n®  system 
was  an  illegal  tying  of  two  products 

«dtf.  cm  a®r  <*««5togs 

With  other  companies  was  indeed 
moxKipoimng  conduct/'  in  ie»ai 
parlance.  Judge  Jackson  ntled  that 
Microsoft  $ bundiing  move  and  its 
behavior  did  violate  antitrust  laws 
rodf* crosoft  is  appealing  his  ruling 
The  goventmem  is  also  expected 

* “?*e  a±,reeLu!  P°!icy  argument 
for  the  expedited  appeal,  given  the 
importance  of  computer  industry  to 
the  economy,  J 


economy, 

,.3f.g0Ven!mem'‘1ii  **y  that  Mi- 
crosoft  s monopoly  is  imposing  a sie- 

wBBa  thiscase  te 
mi  appeal  and  no  remedies  are  in 
Ptece,"  smd  Herbert  Havenkamp  , 

fawfsciw/"rIht  ",!iversHy  °f  lm 

law  seftooi.  li  will  say  that  not  tak* 
ing  the  case  is  a costly  and  that 
this  is  exactly  ^e  kind  of  ease  that 


prem^  Coe the  $u« 
from  the  outset”  J^^'.Badiy  awry 

^ckson'sS™^^  to  *** 

Mantent  to  «dfSS§SS 

s 

yond  recognition  ” in  rf5lr  case  Be- 
crosoft  declared  I"  50u^  so,  Mi- 
“commihed  an  mrav  of  J u<iee 

subs^tiveproceduiler^8"'1 

ciudS  giving  fte1 ^*erosoft  «)- 

time  for  discoverv  and^^ t0<1  Bttle 
M its  defense  to  thl  m,?lstiw 
of  evidence,  ' ®M>andtng  array 


the  evi<fence  fa  ae  case 

£SLd<S5  nmw  Mve 

able  for  i!  ! as.,,ot  *»««!  Suit- 

district  coun“^ ^Tr,"1  m 

"far™L C Urt'  Microsoft  stated 

the  flleraf^^ aPPiication  of 
me  federal  rules  of  evidence  a.-w 

awsarsTE 

”oa_”f  Microsoft  Submitted 
w«t>  newspaper  articles,  even  pre^ 

releases,  as  evidence.  P ss  ' 

th^1h?eJ^fmn,8Rt  ro3««ained 
“MJB®  iMtfitionai  evidence  ore- 

compiaint  was  fded 

SSfKS  practices  MteroToft 
“sea  to  snag  competition.  Thus  the 

tBe  additfonaj’evte 
^d  Annfwt*  ^fP^ies  like  late! 
the  S,t  00  m mansion  of 

St 

^ **»  government 

suggested 

Wrs  before  Judge  Jwffllf 

S®*4  to  the 

should  be  considered  grounds  for  a 
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July  11,2000 


VIA  FAX 

Hon.  Charles  T.  Canady,  Chairman 
Constitution  Subcommittee  of  the 
House  Judiciary  Committee 
362  Ford  House  Office  Bldg, 
Washington,  D.C.  20515-6220 

and 

Hon,  Melvin  L.  Watt,  Ranking  Member 
Constitution  Subcommittee  of  the 
House  Judiciary  Committee 
362  Ford  House  Office  Bldg. 
Washington,  D.C.  20515-6220 

Dear  Representatives  Canady  and  Watt; 


We  are  writing  to  you  about  the  new  FBI  email  surveillance  system  aptly  named  "Carnivore," 
which  gives  law  enforcement  extraordinary'  power  to  intercept  and  analyze  huge  volumes  of 
email.  The  Carnivore  system  gives  law  enforcement  email  interception  capabilities  that  were 
never  contemplated  when  Congress  passed  the  Electronic  Communications  Privacy  Act 
(ECPA),  codified  in  relevant  part  at 1 8 U.S.C.  2510-22  and  1 8 USC '3121-27.  Carnivore  raises 
new  legal  issues  that  cry  out  for  Congressional  attention  if  we  are  to  preserve  Fourth 
Amendment  rights  in  the  digital  age. 


The  existence  of  Carnivore  first  came  to  light  in  the  April  6 testimony  of  Attorney  Robert 
Com-Revcre  to  the  Constitution  Subcommittee,  Its  operation  was  further  detailed  in  a report 
that  appeared  in  today's  Wall  Street  Journal  (copy  attached).  According  to  these  reports,  the 
Carnivore  system  - essentially  a computer  running  specialized  software-  is  attached  directly 
to  an  Internet  Service  Provider's  (ISP)  network.  Carnivore  is  attached  either  when  law 
enforcement  has  a Title  III  order  from  a court  permitting  it  to  intercept  in  real  time  the 
contents  of  the  electronic  communications  of  a specific  indi  vidual,  or  a trap  and  trace  or  pen 
register  order  allowing  to  i t obtain  the  "numbers"  related  to  communications  from  or  to  a 
specified  target. 

But  unlike  the  operation  of  a traditional  a pen  register,  trap  and  trace  device,  or  wiretap  of  a 
conventional  phone  line.  Carnivore  gives  the  FBI  access  to  all  traffic  over  the  ISP’s  network, 
not  just  the  communications  to  or  from  a particular  target.  Carnivore,  which  is  capable  of 
analyzing  millions  of  messages  per  second,  purportedly  retains  only  the  messages  of  the 
specified  target,  although  this  process  takes  place  without  scrutiny  of  either  the  ISP  or  a court. 

Carnivore  permits  access  to  tire  email  of  every  customer  of  an  ISP  and  the  email  of  every 
person  who  communicates  with  them.  Carnivore  is  roughly  equivalent  to  a wiretap  capable  of 
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accessing  the  contents  of  the  conversations  of  ail  of  the  phone  company’s  customers,  with  the 
"assurance"  that  the  FBI  will  record  only  conversations  of  the  specified  target.  This  "trust  us, 
we  are  the  Government"  approach  is  the  antithesis  of  the  procedures  required  under  our  the 
wiretapping  laws.  They  authorize  limited  electronic  surveillance  of  the  communications  of 
specified  persons,  usually  conducted  by  means  of  specified  communications  devices.  They 
place  on  the  provider  of  the  communications  medium  the  responsibility  to  separate  the 
communications  of  persons  authorized  to  be  intercepted  from  other  communications. 


Currently,  law  enforcement  is  required  to  ’’minimize”  its  interception  of  non-incriminating 
communications  of  a target  of  a wiretap  order.  Carnivore  is  not  a minimization  tool.  Instead, 
Carnivore  maximizes  law  enforcement  access  to  the  communications  of  non-targets" 

In  his  testimony  to  your  subcommittee  Mr,  Com -Revere  described  the  experience  of  his  client, 
an  ISP  that  was  required  to  install  Carni  vore  when  presented  with  a trap  and  trace  order.  He 
detailed  his  client's  concerns  that  a trap  and  trace  order  in  the  context  of  the  Internet  revealed 
information  that  Congress  did  not  contemplate  when  it  authorized  their  limited  use.  In  the 
traditional  telephone  context,  those  orders  reveal  nothing  more  than  the  numbers  dialed  to  or 
from  a single  telephone  line.  In  the  Internet  context,  these  orders  and  certainly  Carnivore, 
likely  involve  ascertaining  the  suspect’s  e-mail  address,  as  well  as  header  information  that  may 
provide  information  regarding  the  content  of  the  communication. 


As  we  have  stated  previously,  the  ACLU  does  not  believe  that  it  is  clear  that  the  Government 
can  sene  an  order  on  an  Internet  service  provider  and  obtain  the  e-mail  addresses  of  incoming 
and  outgoing  messages  for  a particular  subscriber.  Further,  it  is  not  clear  whether  law 
enforcement  agents  use  or  should  use  authority  under  the  pen  register  statute  to  access  a 
variety  of  data,  including  Internet  Protocol  addresses,  dialup  numbers  and  e-mail  logs.  We 
certainly  do  not  believe  that  it  is  clear  that  law  enforcement  can  install  a super  trap  and  trace 
device  that  access  to  such  information  for  all  of  an  ISP’s  subscribers. 

In  light  of  the  new  revelations  about  Carnivore,  the  ACLU  urges  the  Subcommittee  to 
accelerate  its  consideration  of  the  application  of  the  4th  Amendment  In  the  digital  age. 
Legislation  should  make  it  clear  that  law  enforcement  agents  may  not  use  devices  that  allow 
access  to  electronic  communications  involving  only  persons  other  than  a specified  target  for 
which  it  has  a proper  order.  Such  legislation  should  make  clear  that  a trap  and  trace  order 
served  on  an  ISP  does  not  authorize  access  to  the  contents  of  any  communication  - including 
the  subject  line  of  a communication  - and  that  the  ISP  bears  the  burden  of  protecting  the 
privacy  of  communications  to  which  FBI  access  has  not  been  granted. 

We  would  be  happy  to  work  with  the  Subcommittee  on  drafting  legislation  that  protects  the 
pri  vaey  rights  of  Americans. 


Sincerely, 


Laura  W.  Murphy 

Director,  ACLU  Washington  National  Office 

Barry  Steinhardt 
Associate  Director,  ACLU 

Gregory  T.  Nojeim 
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Stronger  Online  Privacy  Sought 

By  D.  IAN  HOPPER 

x The  Associated  Press 


WASHINGTON  (AP)  - Lawmakers  are  seeking  ways  to  shore  up  online  privacy  following  reports  of  businesses  selling  custom* 
persona!  information  and  an  FBI  system  that  hunts  for  suspects  by  scanning  citizens’  e-mail. 

Sens.  Patrick  Leahy,  Q-Vt,  and  Robert  Torricelli,  D-N.J.,  introduced  legislation  that  would  bar  the  sate  of  personal  information 
kept  by  a defend  company  if  the  sale  would  have  violated  privacy  policies  in  effect  when  the  company  was  in  business. 

Ihe  bit!  responds  to  the  case  of  Toy  smart,  a former  online  toy  retailer  that  put  all  Its  assets,  including  Its  customer  records  - 
such  as  names,  addresses  and  credit  card  numbers  - up  for  sale  despite  a privacy  policy  that  assured  customers  the  informal 
would  remain  private. 

The  Federal  Trade  Commission  filed  a suit  against  Toysmart  this  week  to  stop  the  sate  from  taking  place.  Rep.  Spencer  Bach 
R-Ala.,  has  already  announced  plans  to  Introduce  a similar  bii!  In  the  House. 

”1!  is  wrong  to  use  our  nation’s  bankruptcy  laws  as  art  excuse  to  violate  a customer's  persona!  privacy,*  the  senators  said  in  a 
tetter  to  colleagues  asking  for  support  for  the  bill.  "Customers  have  a right  to  expect  a firm  to  adhere  to  its  privacy  policies, 
whether  it  is  making  a profit  or  has  filed  for  bankruptcy,* 

The  legislators  say  they  will  try  to  include  the  bill  In  a larger  bankruptcy  reform  package. 

TRUSTe,  an  organization  that  gives  its  sea!  to  Web  sites  that  meet  its  privacy  principles,  blew  the  whistle  on  Toysmart  in  duns 

Earlier  Wednesday,  Waif  Disney,  the  majority  owner  of  Toysmart,  said  it  has  offered  to  purchase  the  company's  fists  and  assure 
their  confidentiality.  * f 

in  a related  action,  two  legislators  are  going  after  "Carnivore,”  a system  in  use  by  the  FBI  to  monitor  suspected  criminals’  e-m;  iff. 
Carnivore  is  installed  at  a suspect’s  Internet  provider  and  scans  through  ail  incoming  and  outgoing  mail,  looking  for  messages 
belonging  to  the  suspect. 

Privacy  groups,  such  as  the  American  Oral  Liberties  Union  and  the  Electronic  information  Privacy  Center,  and  some  internet 
providers  object  to  the  system  because  internet  companies  have  no  control  over  the  "black  box.”  They  say  it  infringes  upon  ths  i 
rights  of  individuals  not  involved  with  the  FBI  investigation. 

The  ACLU  sent  a fetter  to  Rep.  Charles  Canady,  R-Fls.,  detailing  its  concerns.  Canady  will  announce  Thursday  the  date  for 
hearings  on  Carnivore,  his  spokesman  said. 

House  Majority  Leader  Dick  Armey  sent  a tetter  Wednesday  to  Attorney  Generai  Janet  Reno  and  FB!  Director  Louis  Freeh 
blasting  the  agencies  and  the  Clinton  administration  for  the  "cybersnooping*  system. 

The  federal  government  has  the  power  and  the  authority  to  collect  and  maintain  vast  amounts  of  private  personal  information,” 
wrote  Armey,  R-Texas.  "This  administration  continues  to  demonstrate  a cavalier  attitude  with  that  responsibility, * 

Also,  Rep.  Clay  Shaw,  R-Fta.,  will  introduce  a bil!  Thursday  aimed  at  stopping  identity  theft.  The  bill  would  prohibit  the  sate  of 
Social  Security  numbers,  which  can  be  used  to  get  credit  card  numbers,  bank  loans  and  accounts  in  another  person's  name. 

The  FTC  announced  Wednesday  that  calls  to  their  identity  theft  hot  line  are  on  the  rise,  at  about  850  reports  per  week. 

"Identity  theft  is  a terrible  problem  that  has  literally  destroyed  people’s  lives  and  it  must  be  stopped,”  said  Shaw  who  heads  (hi  i 
House  Social  Security  subcommittee. 
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FBI  Cybersnooping  System  Raises 
Additional  Privacy  Concerns 

Armey  to  Administration:  Stay  Out  of  My  Inbox! 
July  12, 2000 


Related  Links 

The  e-Contract 

Remafe  trn  t»ee- 
Contract  with  High 
Tech  America 


FBI  Cybersnoopmg 
SvstemRaises 


House  Majority  Leader  Dick  Armey  today  called  on  Attorney 
General  Janet  Reno  and  FBI  Director  Louis  Freeh  to  address  the 
privacy  concerns  raised  by  the  Federal  Bureau  of  investigation's 
Carnivore  system  of  monitoring  email  traffic.  Armey  issued  the 
following  statement: f 


This  Administration  doesn't  have  the  best  record  on  persona!  privacy.  It 
keeps  repeating  the  same  mistake  over  and  over. 


Only  Violate 
Persons!  Privacy  in 


fe  the  Government  in 

About  internet 
Emm! 


Last  year,  a draft  Administration  proposal  for  a computer  network 
monitoring  system  called  FIDNet  surfaced.  When  I joined  privacy 
advocates  in  questioning  the  legitimacy  of  a government  system  that 
could  monitor  private  sector  networks,  the  Administration  backed  off 
a bit  from  their  original  design.  But  it  has  yet  to  answer  my  question  of 
why  they  intended  to  monitor  private  systems  in  the  first  place. 


Now  the  FBI  wants  to  run  a system  that  could  sort  through  every'  single 
e-mail  message  that  passes  through  a commercial  Internet  sendee 
provider.  I ask,  why  should  we  trust  this  Administration  with  our  most 
personal  correspondence? 

At  a time  when  there  is  a lot  of  talk  about  concerns  for  Internet  privacy, 
the  Ciinton-Gore  Administration  continues  to  push  Big  Brother 
proposals  that  promote  government  cybersnooping.  They  seem  tone  deaf 
to  the  concerns  people  have  about  the  government  invading  their 
privacy.  The  Federal  government  has  the  power  and  the  authority  to 
collect  and  maintain  vast  amounts  of  private  personal  information.  This 
Administration  continues  to  demonstrate  a cavalier  attitude  with  that 
responsibility. 

I call  on  Attorney  General  Reno  and  FBI  Director  Freeh  to  stop  using 
this  cybersnooping  system  until  fourth  amendment  concerns  are 
adequately  addressed. 

Rotated  Correspondence: 

* First  letter  to  AG  Reno 

* Second  letter  to  AG  Reno 

* Third  letter  to  AG  Reno 

* Privacy  violations  at  ONDCP 

* Letter  to  the  president  on  web  privacy 


http://freedom.house.gov/library/technology/camivore.asp 


S/24/62  Release  - Pipe  146 

7/13/00 
">d.  ^ 


1 


f»i  cyoersnoopuig  oystem\.»ises  Additional  privacy  concerns 


Page  2 of 2 


* Letter  to  the  IRS  > 


updates! 


Omni  Page  j jSM.Uajsges  { Features  J News  & info  j Search  £ J 

Freedom  Works  ; Home  Page  of  the  Office  of  the  House  Majority  Leader  X T £ £ ^ 


http://freedonrhouse.gov/Ijbraiy/tedmology/camivore.asp 


5/24/02  Release  * Page:  tOJ 

7/13/00 


4*uuauvci  * canny*..*  liiag&ostie  loot 


httpjh*  *fW£Bl  V/prograiTis./carni vorc/c 


carniTjprc.hts 

'*)£■ 


CARNIVORiSv 


■S  V ^ . 


t' v V OV 


Diagnostic  Tool 


2mS  ^ti^Tmu?^!i0ns  n?tW0fks^re  routine|y  used  m the  commission  of  serious 
SS  S'  including  espionage.  Organized  crime  groups  and  drug  trafficking 
acSes  y y Up0a  telecommunications  to  plan  and  execute  their  crffiai 

™f,!Lflaw  enforcement  agencies  to  conduct  lawful  electronic  surveillance  of  the 

suffix 

based  upon  a defendant’s  own  words.  r , ie  factuai  tssues 

f?r  2Serc!5ption  rec!uire  tt16  authorization  of  a high-level 
Department  of  Justice  (DOJ)  official  before  the  iocal  United  States  Attorneys  offices  can 

hSrJctH UCh  0r5erS/  lnterceP!i0?  orders  must  be  filed  with  federaiS|ycoSdq?s  or 

federal  maoisSs  frenTXniK  Hence-  uKniike  typical  search  warrants^9 
^aS'Strete$  are  not  authorized  to  approve  such  applications  aid  orders  Further 

interception  of  communications  is  limited  so  certain  specified  federal  feiony  offenses 

Applications  for  electronic  surveillance  must  demonstrate  probable  cause  and  sta<e 
part.culanty  and  specificity;  the  offensefs)  being  committed,  the  tefeSSolt  ons  feriiih/ 
or  ptace  from  which  the  subject's  communications  are  to  be  interested  a description  of  ^ 
fee  types  of  conversations  to  be  intercepted,  and  the  identities  of  the  persons  committino 
he  offenses  that  are  anticipated  to  be  intercepted.  Thus,  criminal  elXnfc LrSS? 
laws  focus  on  gathering  hard  evidence  --  not  intelligence.  unemance 

Applications  must  indicate  that  other  normal  investigative  techniques  wflf  not  work  or  are 
too  dangerous,  and  must  include  information  concerning  any  prior  etectronic  survJlwt 

interceptions  must  terminate  sooner  if  the  objectives  are  obtained.  Judoesmav  fanrf 

oroiSSf IT"?  pe!ifiC  C00rt  (typicaliy  every  7‘10<4s)  adXnaft  of  the 

PSssofthe  interception  effort  This  circumstance  thus  assures  dose  and  ongoing 

bl  ibl United  Sta{es  Attorney's  office  handling  the 
°1  * e ord?r  (cons|Sfent  with  requirements  of  the  initial  application  lire6 
permitted,  if  jus  tified,  for  up  to  a period  of  30  days.  ' 8re 

fanoTfiOftU^ii{snce  hfaf  been  ex![erne!y  elective  in  securing  the  conviction  of  more 
than  25,800  dangerous  fetons  over  the  past  13  years,  in  many  cases  there  k no  <*<* 

aS  *"  evtdence  Cann0t  bs  obtained  •«»*  Other  tradkiS 

foSS 

=hi^?Vr^te-W-h  feir  victims.  Because  many  internet  Service  Providers  (ISP)  iacked  the 
abii  ty  to  discriminate  communications  to  identify  a particular  subject's  messages  to  the  n 
exclusion  of  all  others,  the  FBI  designed  and  developed  a diagnostic 

The  Carnivore  device  provides  the  FBI  with  a "surgical”  ability  to  intercept  and  collect  the 
communications  which  are  the  subject  of  the  lawful  order  while  ignoring  feose  6 

communications  which  they  are  not  authorized  to  intercept.  This  type  of  too!  is  necessary 
to  meet  the  stringent  requirements  of  fee  federal  wiretapping  statutes.  necessary 

The  Carnivore  device  works  much  tike  commercial  "sniffers*  and  other  network  diaonmiir 
.cols  used  by  ISPs  every  day,  except  that  it  provides  fee  FBI  wife  a unique  ability  to  °S 
distinguish  between  communications  which  may  be  lawfully  intercepted  and  those  whirh 
may  not  For  example,  if  a court  order  provides  for  fee  iawtul  interception  of  one  tvoe  of 
communication  {e.g.,  e-mail),  but  excludes  al!  other  communications  feg  online^ 
shopping)  the  Carnivore  tool  can  be  configured  to  intercept  only  those  e-mails  being 
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Camivors  serves  to  limit  the  messages  viewable  by  human  eyes  to  those  which  am 
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tool  L l < penalties  tor  misuse  of  the 

nni  ^ ^ ^ evidence*  ss  weii  as  criminal  and  civil  penalties  The  system 

not  suicepisbie  to  abuse  because  it  requires  expertise  to  install  and  operate  and  <snrh  3 
j§£*"*  we  BS  r«qUW  in  »e  coSrt  orders,  with' ffiSSrtK  Xte 

j®  sharing  information  regarding  Carnivore  with  industry  at  this  time  to  assist  ih^m " 

foirrt  Exoertc  Implementation  Section,  at  an  industry  standards  meeting  (the 
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Statement  for  the  Record  of 
Donald  M.  Kerr 
Assistant  Director 
Federal  Bureau  of  Investigation 
Before  the 

United  States  House  of  Representatives 
The  Committee  on  the  Judiciary 
Subcommittee  on  the  Constitution 
Washington,  DC. 

7/24/2000 

Good  afternoon,  Mr.  Chairman,  and  Members  of  the  Subcommittee.  I am  grateful  for  this 
opportunity  to  discuss  the  FBI's  Internet  and  data  interception  capabilities  and  to  help  set  the 
record  straight  regarding  tins  important  issue.  I would  like  to  first  discuss  the  FBI’s  legal 
authority  for  conducting  interceptions  on  the  Internet,  and  then  describe  the  technical  means  by 
which  we  intercept  Internet  communications  in  order  to  obtain  evidence  of  Federal  felonies. 

Two  weeks  ago,  the  Wall  Street  Journal  published  an  article  entitled  "FBI's  system  to  covertly 
search  E-mail  raises  privacy,  legal  issues  ” This  story  was  immediately  followed  by  a number  of 
simitar  repot  ts  in  the  press  and  other  media  depicting  a part  of  our  interception  software  - 
codenamed  Carnivore  as  an  ominous  new  technology  that  raised  concerns  about  the  possibility  of 
its  potential  to  snoop,  without  a court  order,  into  the  private  E-mails  of  American  citizens.  I 
think  that  it  is  important  that  our  statutory  law  enforcement  authorities  be  discussed  openly.  In 
fact,  this  was  the  reason  we  chose  to  share  information  about  this  capability  with  industry  experts 
several  weeks  ago.  As  technology  continues  its  rapid  evolution,  it  is  essential  for  the  public  to 
know  and  understand  their  government  is  scrupulously  observing  the  laws  and  the  constitutional 
protections  that  guarantee  their  right  to  privacy.  It  is  also  very  important  that  these  discussions  be 
placed  into  their  proper  context  and  that  the  relevant  facts  concerning  this  issue  are  made  clear.  I 
welcome  this  opportunity  to  stress  that  our  capabilities  are  used  only  after  lawful  court  ordered 
authorization  and  that  they  are  directed  at  the  most  serious  violations  of  national  security  and 
public  safety. 
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The  FBI  performs  interceptions  of  criminal  wire  and  electronic  communications,  including 
Internet  communications,  under  authorities  derived  from  Title  HI  of  the  Omnibus  Crime  Control 
and  Safe  Streets  Act  of  1968  (as  amended),  which  is  commonly  referred  to  as  "Title  IIP,  and 
portions  of  the  Electronic  Communications  Privacy  Act  of  1986  (as  amended),  or  ”ECPA"  Ail 
such  interceptions,  with  the  exception  of  a rarely  used  "emergency"  authority  or  in  cases  involving 
the  consent  of  a participant  in  the  communication,  are  conducted  pursuant  to  court  orders.  Under 
emergency  provisions,  the  Attorney  General,  the  Deputy  or  the  Associate  Attorney  General  may, 
if  authorized,  initiate  electronic  surveillance  of  wire  or  electronic  communications  without  a court 
order,  but  only  if  an  application  for  such  order  is  made  within  48  hours  after  the  surveillance  is 
initiated.  Last  year,  the  FBI  obtained  Title  ill  court  orders  in  327  instances.  We  did  not  initiate 
surveillances  under  emergency  provisions  of  Tide  III. 


Federal  surveillance  laws  supplement  the  Fourth  Amendment's  dictates  concerning  reasonable 
searches  and  seizures  to  oral,  wire  and  electronic  communications.  They  also  include  a number  of 
additional  provisions  which  ensure  that  this  investigative  technique  is  used  judiciously,  with 
deference  to  the  privacy  of  intercepted  subjects. 

An  application  for  a warrant  to  search  a private  residence  must  be  presented  under  oath  to  a judge 
or  magistrate  who  may  issue  the  warrant  only  upon  a finding  of  probable  cause  to  believe  that  a 
crime  has  been  committed,  and  that  specified  evidence  of  the  crime  will  be  found  in  the  place  to 
be  searched.  Applications  for  Title  III  interceptions  of  wire,  oral  or  electronic  communications 
must  be  presented  to  judges  in  the  same  way  (magist  rates  are  not  authorized  to  approve  Title  ffi 
applications).  However,  before  the  application  can  even  be  submitted  to  the  court,  it  must  be 
authorized  by  a senior  official  of  the  Department  of  Justice  (DOJ).  Title  III  requires  such 
high-level  approval  for  applications  to  intercept  oral  and  wire  communications,  except  in  the  case 
of  digital  pagers,  and  DOJ  policy  requires  the  same  level  of  approval  for  applications  to  intercept 
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electronic  communications,  even  though  the  law  would  allow  lower-level  approval. 


Applications  for  electronic  surveillance  describe  with  particularity  and  specificity  the  particular 
offenses  being  committed,  the  communications  facility  or  place  from  which  the  subject's 
communications  are  to  be  int  ercepted,  a description  of  the  types  of  communications  to  be 
intercepted,  and  the  identities  o!  the  persons  committing  the  offenses  and  anticipated  to  be 
intercepted.  Under  Title  III,  electronic  surveillance  for  criminal  investigations  is  permitted  only 
for  the  purpose  of  gathering  hard  evidence-  not  intelligence. 


Applications  must  indicate  that  other  normal  investigative  techniques  have  been  tried  and  failed  to 
gather  evidence  of  crime,  or  wd!  not  work,  or  are  too  dangerous,  and  must  include  information 
concerning  any  prior  electronic  surveillance  regarding  the  subject  or  facility  in  question.  Court 
orders  are  initially  limited  to  30  days,  with  extensions  possible,  and  must  terminate  sooner  if  t he 
objectives  are  obtained.  Judges  may,  and  usually  do,  require  periodic  reports  to  the  court, 
typically  every1  7 to  10  days,  advising  it  of  the  progress  of  the  interception  effort.  This  assures 
close  and  on-going  oversight  of  the  electronic  surveillance  by  the  United ‘States  Attorney's  office 
handling  the  case.  Interceptions  are  required  to  be  conducted  in  such  a way  as  to  "minimize  the 
interception  of  communications  not  otherwise  subject  to  interception"  under  the  law,  such  as 
unrelated,  irrelevant,  and  non-criminal  communications  of  the  subjects  or  others  not  named  in  the 
application. 


To  ensure  the  evidentiary'  integrity  of  Intercepted  communications  they  must  be  recorded,  if 
possible,  on  magnetic  tape  or  other  devices,  so  as  to  protect  the  recording  from  editing  or  other 
alterations.  Immediately  upon  the  expiration  of  the  interception  period,  these  recordings  must  be 
presented  to  the  federal  district  court  judge  and  sealed  under  his  or  her  directions.  The  presence 
of  t he  seal  is  a prerequisite  for  their  use  or  disclosure,  or  for  the  introduction  of  evidence  derived 
from  the  tapes.  Applications  and  orders  signed  by  the  judge  are  also  to  be  sealed  by  the  judge. 


5/24/02 


Drkerr-I.wpd 
i7C-t 


v$" 


Within  a reasonable  period  of  time  after  the  termination  of  the  interception  order,  the  judge  is 
obligated  by  law  to  ensure  that  the  subject  of  the  interception  order,  and  other  parties  as  are 
deemed  appropriate,  are  furnished  an  inventory  that  includes  notice  of  the  order,  the  dates  during 
which  the  interceptions  were  carried  out  , and  whether  or  not  the  communications  were 
intercepted.  Upon  motion,  the  judge  may  also  direct  that  portions  of  the  contents  of  the 
intercepted  communication  he  made  available  to  affected  persons  for  their  inspection. 


A variety  of  sanctions  are  available  to  penalize  interceptions  conducted  in  violation  of  Title  HI 
ECPA  and  the  Fourth  Amendment  The  evidence  obtained  through  such  unlawful  interceptions 
can  be  suppressed.  The  illegal,  unauthorized  conduct  of  electronic  surveillance  is  a federal 
criminal  offense  punishable  by  imprisonment  for  up  to  five  years,  a fine,  or  both.  In  addition,  any 
person  whose  communications  are  unlawfully  intercepted,  may  recover  in  a civil  action  against  the 
person  or  entity  engaged  in  the  violation,  damages,  including  punitive  damages,  attorney's  fees 
and  other  costs. 


Once  we  obtain  an  order  for  surveillance  of  wire  communications,  we  generally  require  technical 
assistance  front  the  carrier  or  service  provider.  Such  help  is  increasingly  necessary  the  case  with 
the  advent  of  advanced  communications  services  and  networks  such  as  the  Internet.  The  days  of 
connecting  a pair  of  ailegator  clips  connecting  a tape  recorder  to  a copper  wire  phone  are  long 
gone.  Title  HI  mandates  service  provider  assistance  incidental  to  law  enforcement’s  execution  of 
electronic  surveillance  orders.  Upon  the  request  of  the  applicant,  a court  order  authorizing  the 
interception  of  communications  may  direct  that  a telecommunications  “service  provider,  landlord, 
custodian,  or  other  person  shall  furnish  the  applicant  forthwith  all  information,  facilities,  and 
technical  assistance  necessary  to  accomplish  the  interception  unobtrusively  and  with  a minimum  of 
interference  with  the  services  that  such  service  provider,  landlord,  custodian,  or  person  is 
according  the  person  whose  communications  are  to  be  intercepted.11 
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In  practice.  Judges  may  sign  two  orders:  one  order  authorizing  the  law  enforcement  agency  to 
conduct  the  electronic  surveillance,  and  a second,  abbreviated,  assistance  order  directed  to  the 
service  provider,  specifying,  for  example  in  the  case  of  E-mail,  the  E-mail  account  name  of  the 
subject  tha  t is  the  object  of  the  order  and  directing  the  provision  of  necessary  assistance. 

Service  providers  and  their  personnel  are  also  subject  to  the  electronic  surveillance  laws,  meaning 
that  unauthorized  electronic  surveillance  of  their  customers  (or  anyone  else)  is  forbidden,  and 
criminal  and  civil  liability'  may  be  assessed  for  violations.  The  prohibition  on  using  or  disclosing 
the  contents  of  communications  illegally  intercepted,  likewise  extends  to  service  providers  and 
their  personnel.  It  is  for  this  reason,  among  others,  that  service  providers  typically  take  great  care 
in  providing  assistance  to  law  enforcement  in  carrying  out  electronic  surveillance  pursuant  to 
court  order.  In  some  instances,  service  providers  opt  to  provide  “full"  service,  essentially  carrying 
out  the  interception  for  law1  enforcement  and  providing  the  final  interception  product,  but,  in  most 
cases,  service  providers  are  inclined  only  to  provide  the  level  of  assistance  necessary  to  allow  the 
law  enforcement  agency  to  conduct  the  interception. 


In  recent  years,  it  has  become  increasingly  common  for  the  FBI  to  seek,  and  for  judges  to  issue 
orders  for  Title  III  interceptions  more  narrowly  tailored  than  those  in  the  early  years  of  Title  III 
existence  that  were  directed  against  “plain  old  telephone  services.  ” To  be  successfully 
implemented,  these  orders  require  complex  methods  to  ensure  that  only  messages  for  which  there 
is  probable  cause  to  intercept  are,  in  fact,  intercepted.  The  increased  detail  in  court  orders  issued 
under  Title  III  responds  to  two  relatively  recent  developments. 

First,  the  complexity  of  modern  communications  networks,  such  as  the  Internet,  and  t he 
complexity  of  modern  users'  communications  equipment  require  better  discrimination  than  older 
analog  communications.  For  example,  Internet  users  frequently  use  electronic  messaging  services. 
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like  E-mail,  to  communicate  with  other  individuals  in  a manner  reminiscent  of  a telephone  call, 
only  with  text  instead  of  voice.  Such  messages  are  often  the  targets  of  court  ordered  interception. 
Users  also  use  services,  like  the  world  wide  web,  which  looks  more  like  print  media  than  a phone 
call  Similarly,  some  Internet  services,  like  streaming  video,  have  more  in  common  with  broadcast 
media  like  television,  than  with  telephone  calls.  These  types  of  communications  are  less  commonly 
the  t argets  of  an  interception  order. 
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Second,  for  many  Internet  services,  users  share  communications  channels,  addresses,  etc.  These 
factors  make  the  interception  of  messages  for  which  law  enforcement  has  probable  cause,  to  the 
exclusion  of  all  others,  very  difficult.  Court  orders  therefore  increasingly  include  detailed 
instructions  to  preclude  the  interception  of  communications  that  lie  outside  the  scope  of  the  order. 

In  response  to  a critical  need  for  tools  to  implement  complex  court  orders,  the  FBI  developed  a 
number  of  capabilities  including  the  software  program  that  is  known  as  "Carnivore.”  The 
committee  may  be  aware  that  internet  transmissions  are  broken  down  into  packets  of  information 
consisting  of  a string  of  words  or  symbols.  Different  packets  from  the  same  message  often  take 
different  routes  between  the  sender  and  the  intended  recipient.  The  various  packets  constituting  a 
smgie  message  are  labeled  so  that  they  can  be  reassembled  and  read  by  the  recipient.  The 
challenge  for  law  enforcement  Implementing  a court  order  for  interception  of  E-mail  is  to  find  and 
retrieve  only  those  packets  that  are  part  of  a message  covered  by  the  order.  To  do  this,  we 
developed  a software  solution  to  perform  network  analysis.  This  software  runs  on  a standard 
personal  computer  running  the  standard  Microsoft  Windows  operating  system.  It  works  by " 
sniffing"  the  proper  portions  of  network  packets  and  copying  and  storing  only  those  packets 
which  match  a finely  defined  filter  set  programed  in  conformity  with  the  court  order.  This  filter  set 
can  be  extremely  complex,  but  it  provides  the  FBI  with  an  ability  to  collect  only  those 
transmissions  which  comply  with  pen  register  court  orders,  trap  & trace  court  orders,  and  Title  III 
interception  orders. 
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it  is  important  to  understand  what  is  meant  by  “sniffing.  ” The  problem  of  discriminating  between 
users*  messages  on  the  Internet  is  a complex  one.  However,  this  is  exactly  what  our  software 
does.  It  does  NOT  search  through  the  contents  of  every'  message  and  collect  those  that  contain 
certain  key  words  like  “bomb”  or  "drugs."  It  selects  messages  based  on  criteria  expressly  set  out  in 
the  court  order,  for  example,  messages  transmitted  to  or  from  a particular  account  or  to  or  from  a 
particular-  user.  If  the  device  is  placed  at  some  point  on  the  network  where  it  cannot  discriminate 
messages  as  set  out  in  the  court  order,  it  simply  lets  all  such  messages  pass  by  unrecorded. 

One  might  ask,  “why  use  this  program  at  all?"  In  many  instances,  ISPs,  particularly  the  larger 
ones,  maintain  capabilities  which  allow  them  to  comply,  or  partially  comply  with  lawful  orders. 

For  example,  many  ISPs  have  the  capability  to  “clone"  or  intercept,  when  lawfully  ordered  to  do 
so.  E-mail  to  and  from  specified  user  accounts.  In  such  cases,  these  abilities  are  satisfactory  and 
allow  full  compliance  with  a court  order.  However,  in  most  cases,  ISPs  do  not  have  such 
capabilities  or  cannot  employ  them  in  a secure  manner.  Also,  most  systems  devised  by  service 
providers  or  purchased  ’ off  the  shelf*  lack  the  ability  to  properly  discriminate  between  messages 
in  a fashion  that  complies  with  the  court  order.  Also,  many  court  orders  go  beyond  E-mail, 
specifying  other  protocols  to  be  intercepted  such  as  instant  messaging.  In  these  cases,  a cloned 
mailbox  is  not  sufficient  to  comply  with  the  order  of  the  court. 


Now,  I think  it  is  important,  that  you  understand  how  we  use  the  system  in  practice.  First,  there  is 
the  issue  of  scale.  Carnivore  is  a small-scale  tool  intended  for  use  only  when  and  where  it  is 
needed.  In  fact,  each  one  is  maintained  at  the  FBI  Laboratory  in  Quantico  until  it  is  actually 
needed  in  an  active  case.  It  is  then  deployed  to  satisfy  the  needs  of  a single  case  or  court  order, 
and  afterwards,  upon  expiration  of  the  order,  the  device  is  removed  and  returned  to  Quantico. 

The  second  issue  is  one  of  network  interference.  Carnivore  is  safe  to  operate  on  I?  networks.  It  is 
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connected  by  a high  impedance  bridge  and  does  not  have  any  ability  to  transmit  anything  onto  the 
network.  In  fact,  we  go  to  great  lengths  to  ensure  that  our  system  is  satisfactorily  isolated  from 
the  network  to  which  it  is  attached.  Also,  if  is  only  attached  to  the  network  after  consultation 
with,  and  with  the  agreement  of,  technical  personnel  from  the  ISP. 


This  leads  to  the  third  issue-that  of  ISP  cooperation.  To  my  knowledge,  we  have  never  installed 
this  system  onto  an  ISP’s  network  without  assistance  from  the  ISP’s  technical  personnel.  The 
Internet  is  a highly  complex  and  heterogeneous  environment  in  which  to  conduct  such  operations, 
and  I can  assure  you  that  without  the  technical  knowledge  of  the  ISP's  personnel,  it  would  be 
difficult,  if  not  impossible,  for  law  enforcement  agencies  to  successfully  implement  and  comply 
with  the  strict  language  of  an  interception  order.  The  FBI  also  depends  upon  the  ISP  personnel  to 
understand  the  protocols  and  architecture  of  their  particular  networks. 


Another  primary  consideration  for  using  this  system  is  data  integrity.  As  you  know,  Rule  901  of 
the  Federal  Rules  of  Evidence  requires  the  authentication  of  evidence  as  a condition  of  its 
admissibility.  The  use  of  the  Carnivore  system  by  the  FBI  to  intercept  and  store  communications 
provides  lor  an  undisturbed  chain  of  custody  by  providing  a witness  who  can  testify  to  the 
retrieval  of  the  evidence  and  the  process  by  which  it  was  recorded.  Performance  is  another  reason 
for  preferring  this  system  to  commercial  sniffers.  Unlike  commercial  software  sniffers.  Carnivore 
ts  designed  to  intercept  and  record  the  selected  communications  comprehensively,  without 
"dropped  packets." 


In  conclusion,  I want  to  stress  that  the  FBI  does  not  conduct  interceptions,  install  and  operate  pen 
registers,  or  use  trap  & trace  devices  without  lawful  authorization  from  a court.  Over  the  last  five 
years  or  more,  we  have  witnessed  a continuing,  steady  growth  in  instances  of  computer-related 
crimes,  including  traditional  crimes  and  terrorist  activities  that  have  been  planned  or  carried  out, 
in  part,  using  the  Internet,  1 he  ability  of  the  law'  enforcement  community  to  effectively 
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investigate  and  prevent  these  crimes  is,  in  part,  dependant  upon  our  ability  to  lawfully  collect  vital 
evidence  of  wrongdoing.  As  the  Internet  becomes  more  complex,  so  do  the  challenges  placed  on 

us  to  keep  pace.  We  could  no.  do  so  without  the  continued  cooperation  of  our  industry  partners 
and  innovations  such  as  the  Carnivore  software. 


I look  forward  to  working  with  the  subcommittee  staff  to  provide  mote  information 

your  suggestions  on  this  important  issue.  I will  be  happy  to  answer  any  questions  that  you , 
have.  Thank  You. 


and  welcome 
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Alan  Davidson  is  Staff  Counsel  at  the  Center  for 
Democracy  and  Technology  (CDT),  a Washington  D.C. 
non-profit  group  working  to  promote  ci  vil  liberties  on  the 
Internet  and  other  new  digital  media.  Mr,  Davidson  is 
currently  leading  CDT*s  efforts  to  promote  encryption 
policies  that  protect  privacy  and  free  expression  in  the 
information  infrastructure.  He  has  written  and  spoken 
widely  on  the  civil  liberties  implications  of  public  policies 
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legislation.  * r J 
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American  Civil  Liberties  Union 


Freedom  Networic 


In  Unique  Tactic,  ACLU  Seeks  FBI  Computer  Code 
On  "Carnivore"  and  Other  Cybersnoop  Programs 

FOR  IMMEDIATE  RELEASE 
Friday,  July  14, 2000 

UntonHi?lSwNt!^  r Th1  Say  be  **?***  West  of  its  Knd,  the  American  Civil  Liberties 
£ g-  thf  Federal  Bureau  of  Investigation  to  disclose  the  computer  source  code 
and  other  technical  details  about  its  new  Internet  wiretapping  programs. 

In  a Freedom  of  Information  Act  (FOIA)  request  sent  today  to  the  FBI  the  ACLU  is 
seeking  all  agency  records  related  to  the  government  e-mail  "cybersnoop"  programs  dubbed 
Sms'S fcfl?pe*k’  including  "letters,  correspondence,  tape  recordings, 
technicifspSISSS"  ’ COmputer  source  and  ob-*ect  code>  technical  manuals,  [and] 

ST**  "S0UIC1  codeI  ,{he  set  ofinstmetions  for  a program  written  by  its  creators, 
which  is  compiled  into  object  code  ’ which  can  be  read  by  machines. 

"Right  now,  the  FBI  is  running  this  software  out  of  a black  box,"  said  Barry  Steinhardt 
Associate  Director  of  the  ACLU  and  author  of  the  letter.  "The  FBI  is  saying  ‘trust  ?s  we’re 
^'body’s  pnvacy.’  With  all  due  respect,  we’d  like  to  determine  tS  for 

tb1  re<3uef  for  program  source  code  is  the  first  of  its  kind.  But 
Stemhardt  said  that  two  federal  appeals  court  rulings  that  computer  code  is  a form  of 

dJffere~fr?ra  mY  °foer  wntten  document,  support  the  ACLUs  demand  under 
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programs  is  necessary  to  determine  just  how  the  software  operates  and  whether  e-mSl 
pnvacy  is  being  violated. 

of  y ese  foc^fogies  "cry  out  for  Congressional  attention  if  we  are  to 
mem£rsof?on^s?dmen  nghtS  ,a  dlgita!  aSe>"the  ACLU  said  in  a July  1 1 letter  to 

Revelations  about  the  Carnivore  program  also  prompted  calls  for  disclosure  from 

issued  on  July  12,  House  Majority 

Leader  Dick  Armey  called  on  Attorney  General  Janet  Reno  and  FBI  Director  Louis  Free! 
addressed^’  ^ c^8rsnooPm^  system  until  Fourth  Amendment  concerns  are  adequately 

In  addition,  the  House  Judiciaty  Committee  Subcommittee  on  the  Constitution  has 
scheduled  a hearing  on  the  matter  for  Monday,  July  24.  The  ACLU  has  asked  to  submit 
testimony  to  the  Committee. 

The  FBI  has  20  business  days  to  respond  to  the  FOIA  request.  The  ACLU  is  seeking  a 
response  on  an  expedited  basis,  the  letter  said,  "because  this  information  relates  to  8 
impending  policy  decisions  to  which  informed  members  of  the  public  might  contribute  " 


to 
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If  our  request  is  denied  in  whole  or  part,  we  ask  that  you  justify  all  deletions  by  reference 
to  specific  exemptions  of  the  act,”  the  ACLU  letter  concluded.  y 


The  ACLU's  letter  to  the  FBI  follows. 


July  14, 2000 

Attention: 

John  Kelso  Jr. 

Federal  Bureau  of  In  vestigation 
Chief,  FOI/PA  Section,  Rm.  6296  JEH 
Washington,  D.C.  20535-0001 

Dear  Mr.  Kelso: 

We  are  writing  pursuant  to  the  Freedom  of  Information  Act  (5  U.S.C.  Sec.  552)  to  request 
all  agency  records  including  letters,  correspondence,  tape  recordings,  notes,  data 
memoranda,  email,  computer  source  and  object  code,  technical  manuals,  technical 
toe  folSvfng-  °r  ^ °ther  m3terials  held  b>’ the  federal  Bureau  of  Investigation  regarding 

1 . The  computer  system,  software  or  device  known  as  "Carni  vore”,  which  has  been  or  is 
currently  used  by  the  FBI  in  connection  with  trap  and  trace  and  pen  register  orders 
served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the  interception 
ot  the  content  of  electronic  communications  served  on  Internet  Sendee  Providers; 

2.  The  computer  system  software  or  device  known  as  "Omnivore”,  which  has  been  or  is 
currently  used  by  the  FBI  m connection  with  trap  and  trace  and  pen  register  orders 
served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the  interception 
or  toe  content  of  electronic  communications  served  on  Internet  Service  Providers,  and 

3.  The  computer  system,  software  or  device  known  as  "EtherPeek”,  which  has  been  or  is 
currently  used  by  the  FBI  m connection  with  trap  and  trace  and  pen  register  orders 
served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the  interception 
ot  the  content  of  electronic  communications  served  on  Internet  Service  Providers. 

We  seek  a waiver  of  fees  associated  with  the  fulfillment  of  this  request  for  all  search  and 
processing  fees,  pursuant  to  Section  552(a)(4)(A)(ii)(II)  of  the  Freedom  of  Information  Act. 
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Kecor as  are  not  sought  for  commercial  use,  and  as  a representative  of  the  news  media*  the 

American  Cm!  Liberties  Foundation  (ACLU  Foundation)  qualifies  for  a fee  waiver  wider 
this  provision  of  the  FOIA.  The  organization  meets  the  criterion  laid  out  in  Nation  al 
{security  Archive  v.  Department  of  Defense,  where  a representative  of  the  news  media  is 
defined  as  an  entity  that  "gathers  information  of  potential  interest  to  a segment  of  the 
pubhe"  and  "uses  its  editorial  skills  to  turn  raw  materials  into  a distinct  work  and 
distributes  that  work  to  an  audience."  881  F,  2d  at  1387.  The  ACLU  Foundation  publishes 
newsletters,  frequent  press  releases,  news  briefings,  right  to  know  handbooks  and  other 
materials  that  are  disseminated  to  the  pubhe.  Its  material  is  widely  available  to  everyone 
including  tax  exempt  organizations,  not-for-profit  groups,  law  students  and  faculty  for  no 
cost  or  for  a nominal  fee  through  its  public  education  department.  The  ACLU  Foundation 
disseminates  information  through  publications  available  on-line  at  www.aclu.org  as  well. 

In  addition  we  request  a fee  waiver  for  duplication  costs  because  disclosure  of  this 
information  is  m the  public  interest.  It  is  likely  to  contribute  significantly  to  the  public 
understanding  of  the  activities  of  the  government  The  ACLU  Foundation  is  a nonprofit 
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a rese.arc^1  organization  working  to  increase  citizen  partkiDatior*  in 

governance  issues.  Hie  ACLU  Foundation  is  mstino  fKic  'r&rfti&ei  ifP-.  it  ^ 


technology  and  the  rapid  gmwftoS  World  wSle  Web  SfdSnSfhf,  , 
increased  the  communications  interconnectedness  of  all  the  countries  in  die  world' 6 great  y 
especially  technologically  advanced  nations  like  the  OS  and  the  Netherlands. 

toeXS  noSlS  reVifW  ?Pm  re(3ucst  because  this  infomtation  relates  to 
unpendmg  policy  decisions  to  which  mfenned  members  of  the  public  might  contrihnfie. 
Timely  public  access  to  these  materials  is  necessary  to  fully  inform  fhe^S^wi 
issues  surrounding  conununications  interception  X* 

SDed/cevpmiwtf^f?  Wh?w0rpartl  we  ask  {hat  you  justify  all  deletions  by  reference  to 

552(a)(6){A)(Ud  t0  >0UI  Wlt*im  20  busmess  da>'s> as  the  statute  requires  under  Section 

Thank  you  for  your  assistance. 

Sincerely, 

Bany'  Steinhardt,  Esq. 

On  behalf  of  the  ACLU  Foundation 


moot  ( KM 
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ACLU  Urges  Congress  to  Put  a Leash  on  "Carnivore” 

And  Other  Government  Snoopware  Programs 

FOR  IMMEDIATE  RELEASE 
Wednesday,  July  12, 2000 

WASHINGTON  — Law  enforcement  officials  using  new  surveillance  technologies  online 
are  racing  far  ahead  of  established  privacy  law  and  must  be  reined  in,  the  Amencan  Civil 
Liberties  Union  said  today. 

In  a Msrsent  to  Charles  T , Canady,  R-FL,  Chair  of  the  Constitution  Subcommi  ttee  of  the 
House  Judiciary  Committee,  and  ranMng  member  Melvin  L.  Watt,  D-NC,  the  ACLU  said 
tlist  the  unbridled  uses  of  these  technologies  f,cry  out  for  Oongressionsl  attention  if  we  etc 
to  preserve  Fourth  Amendment  rights  in  the  digital  age." 

Specifically,  the  ACLU  sharply  criticized  the  FBI's  new  online  wiretapping  program 
dubbed  “Carnivore that  uses  Internet  Sendee  Providers  (ISPs)  to  intercept  and  analyze 
huge  amounts  of  e-mail  from  suspects  and  non-suspects  alike. 

It  is  high  time  that  lawmakers  put  a leash  on  Carnivore  and  other  government  schemes  that 
go  way  beyond  what  Congress  authorized  under  the  Electronic  Communications  Protection 
Act,"  said  Laura  W.  Murphy,  director  of  the  ACLU's  Washington  National  Office  and  an 
author  of  the  letter. 

Currently,  law-  enforcement  is  required  to  "minimize”  its  interception  of  non-incriminating 
communications  of  a target  of  a wiretap  order.  But  Carnivore  does  just  the  opposite, 

Murphy  said,  by  sweeping  in  e-mails  from  innocent  Internet  users  as  well  as  the  targeted 
suspect.  , 6 

B arry  Steiohardt,  Associ  ate  Director  of  the  ACLU  and  an  author  of  the  letter,  said  that 
mipiementing  Carnivore  "is  comparable  to  allowing  government  agents  to  rip  open  Post 
Office  mailbags  and  scan  every  piece  of  mail  in  search  of  one  speci  fic  letter  whose  address 
they  already  know.” 

He  also  noted  that  while  the  system  is  plugged  into  the  ISP,  it  is  controlled  solely  by  the  law 
enforcement  agency.  In  a traditional  wiretap,  the  tap  is  physically  placed  and  maintained  by 
the  telephone  company.  J 

pe  snoopware  program  first  came  to  light  during  an  April  6 hearing  before  the  Constitution 
Subcommittee.  The  Carnivore  system  - essentially  a computer  running  specialized 
software-  is  attached  either  when  law  enforcement  has  a court  order  permitting  it  to 
intercept  in  "real  time”  the  contents  of  the  elec  tronic  communications  of  a specific 
individual,  or  a trap-and-trace  or  pen  register  order  allowing  to  it  obtain  the  numbers  related 
to  communications  from  or  to  a specified  target. 

But  "in  the  Internet  context,"  the  ACLU  letter  said,  “these  orders  and  certainly  Carnivore 
likely  involve  ascertaining  the  suspect's  e-mail  address,  as  well  as  header  information  that 
may  provide  information  regarding  the  content  of  the  communication." 

In  urging  Congress  to  accelerate  its  consideration  of  applying  Fourth  Amendment  principles 
in  the  digital  age,  "we  would  be  happy  to  work  with  the  Subcommittee  on  drafting 
legislation  that  protec  ts  the  privacy  rights  of  Americans,*'  the  ACLU  l etter  said. 

> 
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the  April  6 hearing. 


plated  development,  the  ACLU  has  criticized  other  government  surveillance 
schemes,  mcludmg  a global  electronic  surveillance  system  - known  by  the  code  name  of 

worldvride"  **** 58  captunng  sale51lte>  microwave,  cellular  and  fiber-optic  communications 


The  ACIXPs  letter  on  Carnivore  is  online  at:  j^//wwwtae1a.org/congressA071  I rina  hbpf 

For  more  information  on  the  April  6 hearing,  click 
fojKfew.achi.or^ 

For  more  information  on  "Echelon,"  go  to  http://www. 
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American  Civil  Liberties  Union 
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July  11,2000 
VIA  FAX 

Hon.  Charles  T.  Canady,  Chairman 
Constitution  Subcommittee  of  the 
House  Judiciary  Committee 
362  Ford  House  Office  Bldg. 
Washington,  D.C.  20515-6220 


Hon.  Melvin  L.  Watt,  Ranking  Member 
Constitution  Subcommittee  of  the 
House  Judiciary  Committee 
362  Ford  House  Office  Bldg. 
Washington,  D.C.  20515-6220 


Dear  Representatives  Canady  and  Watt: 


' — «vv,„v,*v  wAMuvimHtuj  vu  ijuci^epi  ana  analyse 

huge  volumes  of  email.  The  Carnivore  system  gives  law  enforcement  email  interception 
capabilities  that  were  never  contemplated  when  Congress  passed  the  Electronic 
, f ^riva?y  Act  (hCPA),  codified  in  relevant  part  at  1 8 U.S.C.  25 1 0-22  and 

IK  UhC  3121-27.  Carnivore  raises  new  legal  issues  that  cry  out  for  Congressional  attention 
if  we  are  to  preserve  Fourth  Amendment  rights  in  the  digital  age. 

The  existence  of  Carnivore  first  came  to  light  in  the  April  6 testimony  of  Attorney  Robert 
Com-Revereto  the  Constitution  Subcommittee.  Its  operation  was  further  detailed  in  a report 
mat  appeared  m today's  Wall  Street  Journal  (copy  attached).  According  to  these  reports  the 
Carnivore  system  - essentially  a computer  running  specialized  software-  is  attached 
directly  to  an  Internet  Seryice  Proyide-r's  (ISP)  network.  Carnivore  is  attached  either  when 
law  enforcement  has  a Title  III  order  from  a court  permitting  it  to  intercept  in  real  time  the 
contents  of  the  electronic  communications  of  a specific  individual,  or  a trap  and  trace  or  pen 
register  order  allowing  to  tt  obtain  the  "numbers"  related  to  communications  from  or  to  aP 
specified  target 

But  unlike  the  operation  of  a traditional  a pen  register,  trap  and  trace  device,  or  wiretap  of  a 
conventional  phone  line,  Carnivore  gives  the  FBI  access  to  all  traffic  over  the  ISP's 
network,  not  just  the  communications  to  or  from  a particular  target.  Carnivore  which  is 
capable  of  analyzing  millions  of  messages  per  second,  purportedly  retains  only  the 

fiCd  tafget’ aitll0U§h  this  Process  takes  place  without  scrutiny  of  either 


Carnivore  permits  access  to  the  email  of  every  customer  of  an  ISP  and  the  email  of  every 
person  who  communicates  with  them.  Carnivore  is  roughly  equivalent  to  a wiretap  capable 
of  accessing  the  contents  of  the  conversations  of  all  of  the  phone  company's  customers  with 
the  "assurance”  that  the  FBI  will  record  only  conversations  of  the  specified  target  This* 

'trust  us,  we  are  the  Government"  approach  is  the  antithesis  of  the  procedures  required 
under  our  the  wiretapping  laws.  They  authorize  limited  electronic  surveillance  of  the 
communications  of  specified  persons,  usually  conducted  by  means  of  specified 
communications  devices.  They  place  on  the  prorider  of  the  communications  medium  the 
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responsibility  to  separate  the  communications  of  persons  authorized  to  be  intercepted  from 
other  communications. 


Currently,  law  enforcement  is  required  to  "minimize”  its  interception  of  non-incriminating 
communications  of  a target  of  a wiretap  order.  Carnivore  is  not  a minimization  tool.  Instead 
Carnivore  maximizes  law  enforcement  access  to  the  communications  of  non-targets. 


In  his  testimony  to  yo  ur  subcommittee  Mr.  Com-Revere  described  the  experi  ence  of  his 
client,  an  ISP  that  was  required  to  install  Carnivore  when  presented  with  a trap  and  trace 
order.  He  detailed  his  client's  concerns  that  a trap  and  trace  order  in  the  context  of  the 
Internet  revealed  information  that  Congress  did  not  contemplate  when  it  authorized  their 
limited  use.  In  the  traditional  telephone  context,  those  orders  reveal  nothing  more  than  the 
numbers  dialed  to  or  from  a single  telephone  line.  In  the  Internet  contex  t,  these  orders  and 
certainly  Carnivore,  likely  involve  ascertaining  the  suspect's  e-mail  address,  as  well  as 
header  information  that  may  provide  information  regarding  the  content  of  the 
communication. 


As  we  have  stated  previously,  the  ACLU  does  not  believe  that  it  is  clear  that  the 
Government  can  serve  an  order  on  an  Internet  service  provider  and  obtain  die  e-mail 
addresses  of  incoming  and  outgoing  messages  for  a particular  subscriber.  Further,  it  is  not 
clear  whether  law  enforcement  agents  use  or  should  use  authority  under  the  pen  register 
statute  to  access  a variety  of  data,  including  Internet  Protocol  addresses,  dialup  numbers  and 
e-mail  logs.  We  certainly  do  not  believe  that  it  is  clear  that  law  enforcement  can  install  a 
super  trap  and  trace  device  that  access  to  such  information  for  ail  of  an  ISP's  subscribers. 

In  light  of  the  new  revelations  about  Carnivore,  the  ACLU  urges  the  Subcommittee  to 
accelerate  its  consideration  of  the  application  of  the  4th  Amendment  in  the  digital  age. 
Legislation  should  make  it  clear  that  law  enforcement  agents  may  not  use  devices  that  allow 
access  to  electronic  communications  involving  only  persons  other  than  a specified  target  for 
which  it  has  a proper  order.  Such  legislation  should  make  clear  that  a trap  and  trace  order 
served  on  an  ISP  does  not  authorize  access  to  the  contents  of  any  communication  - 
including  the  subject  line  of  a communication  - and  that  the  ISP  bears  the  burden  of 

protecting  the  privacy  of  communications  to  which  FBI  access  has  not  been  granted. 

* 

We  would  be  happy  to  work  with  the  Subcommittee  on  drafting  legislation  that  protects  the 
privacy  rights  of  Americans  . 


Sincerely, 


Laura  W.  Murphy 

Director,  ACLU  Washington  National  Office 

Barry  Steinhardt 
Associate  Director,  ACLU 


Gregory  T.  Nojeira 

Legislative  Counsel,  ACLU  Washington  National  Office 

cc:  Members  of  the  Constitution  Subcommittee  of  the  House  Judiciary  Committee 
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» alt.privacy,spyware 


» Fftfpm:  aitprivaey  .spyware 
» ISaag:  ‘Carnivore*  Wont  Devour  Cyber-Privacy 

» Message  1 1 of  1589 

Subject:  Re:  ‘Carnivore*  Wont  Devour  Cyber-Privacy 

Date:  07/22/2000 

Author:  huskv  <ebminfa(85riioSs»s 


.Save,  W?  this?,  d 


Career 
IJS80"  Ccnic? 


Message  segment  2 of  2 - Get  i 


5 


if  you  give  up  your  persona!  privacy,  every  other  freedom  will  follow  shortiy.  Though  for  my 
bucte. ! say  let  carnivore  loose.  Whether  carnivore  does  tts'teb  or  not  has  little  tel#^ 
whether  or  not  your  health  or  credit  records  are  safe,  if  youVe  posted  your  credit  card  'Iwwhere 

• \.  ■ <•  v; •.-■  . • ••  • • ;•%•>•••/ 

^Fixing  the  relationship  between  Washington  and  Silicon  Valley  needs  to 

^op  priority  for  the  next  administration.  The  only  people  beriefiteng ' ' • ' 

> controversies  like  the  one  over  Carnivore  are  terrorists,  criminals  and : -./i-Cf 

> rogue  states.  -^-7?  : 

SX^^Z&ssts:  *•  a“™  "roups ""  t ?’****• 

Carnivore  Is  just  the  current  subject  under  scrutiny.'  v 1 v ; 

■"*' - y0y  haven<t  8ny  feaSOT  t0 


« previo 


• * - v^  >V  >•;  V,  - . 

next  In  search  » 


f .spyware 
friend 


^reate  a custom  Imk  to  this  message  from  your  own  Web 


Search  { . . v , 

Dhcuso | :;»r 
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JOB! 


» altcomp.freeware 


*>  sltcompYreewar* 

>>  I fe£gM:  British  law  would  allow  polled  to  Intercept  e-mail 

» Message  2 of  1589 

Subject:  Re:  British  law  would  allow  police  to  Intercept  e-mail 
Date:  07/24/2000 

Author:  T*tiiesln2  <t3llesin2@eafthlmk,net> 

fctttu.lfllijij  « previous  In 

Message  segment  1.  of  2 - Get  Next  Segment  - Get  All  2 Seam? 

URGENT  ACTION  ITEM!  Congress  agrees  to  hold  1 

hearing  on  Monday  in  response  to  public  outrage 
over  FBI's  e-mail  spy  scheme  ‘ 


next  in  search » 


• - : ■ ^ V'  -:-V  ” - ••  - - •• 

you  are  receiving  this  alert  because  you  participated  in  M&d-z 
DefendYourPffvacy.com^  successful  1999  campaign  against  the 
FDIC^  proposed  Know  Your  Customer  bank  spying  regulation,  if 
you  do  not  want  to  receive  further  updates,  please  use  the 
unsubscribe  directions  at  the  end  of  this  message. 


* immediate  action  required:  Help  us  Kill  the  V; : : . ' L L ' 

Carnivore!  • \ v.  * r '•  ^ 

On  July  14  we  issued  e press  release  about  an  FBI  cybersnooplng  device  ^e-named' 
Carnivore,  which  can  scan  millions  of  e-malts  per  second.  Because  Carnivore  has  unlimited 
ppwer  to  spy  on  almost  eveiyone  with  an  e-mail  account*  H may^be  the  biggest  threat  to  your 

privacy  ever/  ; , ' ' ;T  ^ ' 

Almost  immediately  after. die  existence  of  this  project  was  disclosed  in  aJulyll  Wall  Street  • 
Joumafarticfe,  oubtic  outnaae  heoan  to  mohof  -i-  mA 


Politicians  on 


an  TnveSSga&oh*  into 


Toward  this  e-mail  to 


developed  at  its  lab  in  Guantico*  Va.  Dubbed  Carnivore  bacausa.of  its  ability  to  find  *th©  meal* 
among  millions  of  e-mails,  Carnivore  scabs  every. ^IrKomSitg  Iin3oi&oing  e^nan  message  on  a 
network  looking  for'tetete«^;vn«»HMi4  and  saves  those^Ossages  for  later  retrieval  by 
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law  enforcement,  Cai 
feiayd>atsessbna^ 


The  FBI  admits  that  Carnivore  will  scan  millions  of  e-mail  l^noc^  : 

finds  ^y.nu!^:4.me^a9e$from  people  suspected  pittim&M&UM  different than#  the 

FBI  opened  evervone^  mail  hooino  to  find  & tetter  fmm  » rrimte-ai  r\r  An  AuaniAnA^ 


Though  Carnivore’s  existence  was  fust  publicly  revealed,  the  FBI  has  already 

device  at  dozens  of  internet  Service  Providers  (ISPs)  around  .the  country,:  and  claims  jit  Ms 

used  ft  *fewer  than  SB  times*  so  for.  In  m anv  oa fho  Fftt  fcAAn«s  th*  a wia/t 


on  the  l: 
retrieve 


Many  isps  have  refused  to  allow  the  FBI  to  install  Carnivore,  qting  coricsms.that^ the  privacy^ 
of  a>  X . customers  could  be  violated.  But  earlier  this  year,  a federal  judge  ruled  against  brie 
SUCh  ISP*  teaViriQ  It  HO  Choice  but  to  allow  the  FBI  aortas  fri ff*  5 


Predictably,  the  F8i  promises  to  limit  surveillance  to  messages  frote  suspected  hackers*-.’ 
terrorists,  pr  dnig  defers/  But  considering  that  this  is  the  same  agency  that  quietly  inserted : 
roving  telephone  tap*  authority  into  federal  law  and  illegally  turned  over  confidential  personnel 
files  to  the  Clinton .V^hite  House*  you  shouldn't  be  expected  to  trust  ft  with  yourobriftdsritialV^'.- 
e*mans; : :-v  "•  ;•■>. *•>“/ ■ ?v;  •;  ' ' •;  vV^V c?  ■•  ••  •.' 

But  Carnivore  is  more  than  a threat  to  your  ordinary  e-mail  V;?";'  : r/vf 

correspondence  - ft  also  gives  government  bureaucrats  the  ability  to  spy  on  your  online 
banking  transactions,  because  ft  has  the  ability  to  monitor  afi  digital  communications;  Th© 
bottom  line  is  that  your  privacy  won't  be  protected  as  long  as  Carnivore  is  on  the  loose. 
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Telecoms  Miffed  at  FBI  Meddling 

fay  Peelan  McCu»a?fr 

3:00  a.m.  jyf,  8,  2000  POT 

t?de  assodstion  this  week  criticized  a recent  FBI  move  to  thwart  the  $S  5 
billion  sale  of  ISP  Veno  to  a Japanese  Firm,  * 

The  FBI's  objections  that  the  Fed  agency  may  not  be  able  to  conduct  the  kind  of  Internet 
surveilfance  it  desires  are  specious,  said  the  Computer  and  Communications  Industry  Association, 


Everybody’s  got  issues  in  Politics 
/■fore  Fundincrfor  FBI  Snooping 


I of  2 


“In  taking  this  action  the  FBI  runs  the  serious  risk  of  frustrating  the  openness  of  Internet 
communications,  infringing  our  civil  liberties,  and  damaging  our  relations  with  important  trading 
^>S?i S3id  Ed  B ac^'  President  of  the  CCIA.  The  groups’  members  include  AT&T,  Norte!  Nokia 
and  NTT  America,  the  Japanese  company  which  hopes  to  purchase  Verio. 

Last  £®af' the  FBI  MQsypcgssfuiiy^sskgd  the  Internet  Engineering  Task  Force  to  build  wiretap 
capabilities  into  protocols,  FBI  Director  Louis  Freeh  has,  in  the  past,  asked  Congress  for  domestic 
controls  on  data-scrambling  encryption  products  and  successfully  pressed  for  a "digital  telephony" 
Feds  ^ ^ requires  telephone  companies  to  ensure  that  their  networks  are  able  to  be  tapped  by  the 

Anti-anonymity;  If  you  criticize  a Pennsylvania  judge  online,  be  warned:  You  may  not  be  as 
anonymous  as  you  thought  y 

Thin-skinned  Superior  Court  Judge  Joan  Orie  Melvin  in  earfy  1999  sued  over  a dozen  “John  Does" 
that  she  suspected  of  posting  messages  on  a muckraking  site  devoted  to  Pittsburgh  politics, 

A judge  who  recently  heard  arguments  in  Melvin’s  case  will  decide  whether  or  not  to  unmask  the 
folks  who  partic'pated  in  the  “Grant  Street  99"  site,  according  to  an  artirte  in  the  Pittsburgh 

* * * v AvflCfi 

the  Jfhn.?feS/  indudm9  ar>e  who  reportedly  alleged  that  Judge  Melvin  was 
engaged  in  surreptitious  and  — if  true  — unlawful  partisan  political  activity* 

Bill  Joy  a Killjoy?  An  article  on  the  website  of  the  conservative  National  Review  takes  aim  at  Bill 
Joy  of  Sun  Microsystems,  who  recently  raised  eyebrows  when  he  warned  of  the  dancers  of 
unregulated  technology,  9ereof 

Authors  Glenn  Reynolds  and  Dave  Kopel  said  Joy’s  article,  published  earlier  this  year  In  Wired 
Magazine,  is  an  example  of  "neo-luddite  sentiment," 

"More  generally,  Luddite  intellectuals  are  successfully  propagating  ’the  precautionary  principle  ’ 
which  states  that  we  should  never  try  anything  new  unless  we  are  certain  that  ft  is  absolutely ‘ 
safe...  Even  worse,  ’’relinquishment"  would  probably  accelerate  the  progress  of  destructive 
nanotechnology.  In  a world  where  nanotechnology  is  outlawed,  outlaws  would  have  an  additional 
incentive  to  develop  nanotechnology,"  the  National  Review  authors  wrote. 

Upcoming  events;  Two  U.S.  senators  are  holding  a briefing  on  medical  and  genetic  privacy  on 
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FBI  taps  of  e-mail  provoke  concerns 

Privacy  issues  lead  to  House  hearings  on  ‘Carnivore’  work;  Name  called 
'unfortunate' 


By  Del  Quentin  Wilber 
Sun  National  Staff 


its  name;  "Carnivore. 


ominous  as 


Attached  to  an  ISP's  server,  the  contraption  sifts  through  countless  e-mail 
messages  and  copies  specific  information  for  federal  agents  seeking 
suspected  criminals,  including  terrorists  and  child  pomographers. 

But  critics  say  that,  in  the  process  of  sifting  out  communications  from  its 
targets,  Carnivore  is  also  capable  of  retrieving  the  private  messages  of 
innocent  people.  ° 

"This  is  a very  dangerous  device,"  said  Barry  Steinhardt,  associate  director  of 
the  American  Civil  Liberties  Union.  "It's  unprecedented.  It's  the  first  time 

law  enforcement  has  carte  blanche  access  to  the  entire  service  provider’s 
network."  * 

The  controversysunounding  the  device  with  the  foreboding  name  has  caught 
the  attention  of  Republican  lawmakers,  and  a House  Judiciary  subcommittee 
is  scheduled  to  hold  a hearing  on  the  matter  today.  Opponents  and  authorities 
who  support  the  use  of  Carnivore  are  scheduled  to  testify. 

After  the  system  was  disclosed  in  recent  news  accounts,  sparking  criticism 
nom  privacy  advocates,  FBI  officials  met  with  lawmakers  and  reporters  to 
try  to  show  that  Carnivore  is  not  nearly  as  intrusive  as  some  feat* 

For  one  thing,  FBI  officials  said,  they  need  the  device  to  combat  crime  and 
threats  to  nationaUecurity.  They  describe  Carnivore  as  a "surgical”  tool  that 
would  protect  ordinary  people  from  unintended  searches. 

"There  are  filtering  mechanisms  built  in  that  limit  the  amount  of  information 
viewable  to  the  human  eye,"  said  Paul  Bresson,  a spokesman  for  the  bureau. 

It  ensures  that  only  the  exact  conununications  authorized  by  a court  are 
what  we  intercept/' 

For  decades,  federal  agents  and  local  police  have  been  wiretapping  suspects' 
phones  after  obtaining  permission  from  judges.  But  those  wiretaps  are 
limited  to  a specific  suspect  and  do  not  comb  through  phone  calls  at  random. 

Carnivore  works  much  differently,  though  authorities  still  must  obtain 
permission  from  a judge  to  scour  e-mail  messages  or  discover  which  Web 
pages  a suspect  visits. 


Once  they  have  court  approval,  agents  attach  the  Carnivore  device  - 


an 
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ordinal-looking  desktop  computer  - to  the  ISP's  main  computer,  and 
Carnivore  passively  sniffs  through  streams  of  data,  FBI  officials  said. 

£^S°r?  d°e\n0t  read  e*mad  messa£es  ot  the*r  subject  lines,  officials  said. 
Instead,  it  searches  for  computer  codes  that  direct  the  message  to  and  from 
the  suspect.  Nor  can  it  scan  e-mail  messages  for  key  words,  like  "drugs  or 
oomo,  an  FBI  official  said. 

aut^ties  say.  Carnivore  acts  like  an  FBI  agent  authorized  to 
scan  envelopes  sent  by  mail.  The  agent  seeks  a particular  suspect's 
addressing  information  and  pulls  aside  any  qualified  envelope  and  opens  it 

Last  week,  after  an  outcry  from  critics,  the  White  House  said  it  would 
propose  legislation  to  among  other  things,  require  agents  to  seek  Justice 
Department  clearance  before  asking  judges  to  authorize  the  use  of  Carnivore 
in  a specific  case.  Such  rules  already  cover  voice  wiretaps. 

But  the  proposal  was  dismissed  by  civil  liberties  groups,  who  said  it  did  not 
go  tar  enough  in  protecting  electronic  communication. 

For  their  part,  FBI  officials  say,  the  White  House  proposal  is  not  necessary; 
They  say  they  abide  by  the  rules  governing  voice  wiretaps  to  use  Carnivore. 

Despite  the  assurances  of  FBI  officials,  civil  liberties  groups  and 
congressional  Republicans  say  they  are  war}'  of  the  system. 

? «as  ^capabiHty  of  grabbing  it  all,"  said  Richard  Diamond,  a spokesman 
for  Rep.  Dick  Armey,  the  Texas  Republican  who  is  the  House  majority 
leader  and  a sharp  critic  of  Carnivore.  "It  all  depends  on  who  pushes  the 

bmton.  Someone  could  push  the  wrong  button  and  have  access  to  all  sorts  of 
information."  v 

FBI  officials  dispute  that  assertion,  though  they  concede  that  Carnivore  has 
sometimes  captured  e-mail  messages  and  data  that  were  not  targeted  in  their 
searches.  They  say  they  sealed  such  information  and  did  not  read  it. 

Earlier  this  year,  an  ISP  tried  unsuccessfully  to  prevent  FBI  agents  from 

cSil!r  ,g  C?™re  an^ts  network.  After  a brief  court  fight,  the  company, 
Earthlink,  yielded  to  FBI  demands  and  helped  install  the  device.  ^ 

FBI  officials  say  they  don't  mind  simply  asking  ISPs  to  provide  them  with 
e-mai!  sent  by  criminal  suspects  if  that  is  possible.  But,  m most  cases,  agents 
would  rather  use  Carnivore  because  it  helps  maintain  security  for  criminal 
evidence.  And  many  smaller  ISPs  are  not  capable  of  creatine  urograms  to 
obtain  the  necessary  data,  FBI  officials  said.  ® 

Though  most  ISPs  have  complied  with  court  orders  to  install  Carnivore  one 
major  provider  said  it  would  refuse.  1 

"Wehe  not  going  to  stand  for  this,"  said  William  L,  Schrader,  chairman  and 
chief  executive  officer  of  PSINet  Inc.  "It's  insidious.  If  they  were  to  ask  us 
with  a court  order  to  violate  the  privacy  of  all  our  customers  we  would  take 
this  to  the  Supreme  Court." 
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Authorities  say  that  more  criminals,  especially  those  involved  in  child 
comm^rimeT^  ^3U^’ 2re  *ncreasingly  using  die  Internet  and  e-mail  to 

About  three  years  ago,  agents  and  federal  prosecutors  began  asking  for 

«S2»  aCCe$S  t0  e.^aU  mi  Web‘site  v>sits>  FBI  officials  said.  Ae  agents 
said  they  were  worried  about  not  having  reliable  and  up-to-date  intelligence. 

FBI  technicians  began  developing  Carnivore,  which  was  used  for  the  first 
Snl  n m°u  aJ°*  *uthorities  FBI  officials  declined  to  disclose 

S2I  Mm2rn,V0'*'reh''d  0381:5  but  said  *•  system  has  bee" 

ScusSoSoRwm^m  IM1re",  fT6-  °f  a na?,e  tafag  internal 

discussions  of  the  program.  At  first,  technicians  called  it  "Omnivore"  because 

frlfft  « S5ght' But  ? ?e  SyS?®  became  wore  refined,  technicians 

felt  it  needed  a better  name  and  changed  it  to  Carnivore:  a meat-eater. 

"^/^0'°?ng5  how,wenarae  a lot  of  Projects  right  now,"  an  FBI  official 
said.  This  has  been  sobering/* 

FBI  agents  noted  that  they  don't  need  Carnivore  to  read  most  old  e-mail 
messages  stored  on  ISP  servers;  they  can  already  do  so  with  court  approval. 

They  described  the  Carnivore  system  as  a last-resort  measure  to  capture 
real-time  communications.  * 

Authorities  on  technology  and  society  say  they  are  hardly  surprised  that  the 
system  has  generated  anxiety,  because  many  people  now'  send  more  personal 

information  over  e-mail  than  over  the  phone.  ^ V 

Corporate  snooping  of  employee  e-mail  and  the  unauthorized  sale  of  client 
information  by  e-retailers  have  unnerved  many  computer  users. 

Originally  published  Jut  24  2000 


News  { Sports } Features  j Opinion  J Classified 
www.sunspot.net 


5/24/02  Release  - Page  jj  87  & 
7/24/00  ll:3f  AN§ 


is/WoM 

\*ii 


m 


, '<*'■ 


FBli  'Carnivore*  will  play  nice 

r 

* 

, ' Homepage  « Kaws  » Mooty  « Ufe  . Sports  » Weather  > Mwtotplaw 


*3 


' +<%  ■eAn#W^:*VVJr-V.\^fc,v  jiL'i  V V . Zj  !! !j j 

hl'«^^'^-usatoda>,-co^ife/cyber/lcch;'cri: 


HEED  TO  GET  CUSA 
, AWAT?j~  ^TCX^Y 


CLICK  HERE! 


VERIO 

the  new  world  of  business 


mm 

-63,htm 


nauoo.tMMMitntn 

FBI:  ’Carnivore'  will  play  nice 

During  demonstration,  details  of  e-mail  ’wiretap*  system  emerge 

WASHINGTON  (Bloomberg)  — The  FBI's  Carnivore  e-mail 
surveillance  system  won't  snoop  on  innocent  Internet  users,  officials 
said  Friday, 
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FBI  officials  gave  reporters  a 
demons  tration  of  the  system  they 
say  adopts  traditional  telephone 
wiretap  methods  to  the  Internet 
without  violating  the  rights  of 
law-abiding  Web  surfers. 


The  disclosure  that  the  FBI  and 
Internet  service  providers  have 
cooperated  to  bug  the  messages 
of  criminal  suspects  has  generated  cri  ticism  from  civil  liberties  groups 
and  some  Republican  lawmakers.  They  say  Carnivore  will  let  the  FBI 
see  e-mails  oi  all  Internet  subscribers,  not  just  the  few  suspects  the  FBI 
wants  to  track.  , r 

FBI  officials  will  defend  Carnivore  Monday  before  a U.S.  House 
Judiciary'  subcommittee  headed  by  Republican  Henry  Hyde  of  Illinois, 

Earlier  this  week,  the  Clinton  administration  proposed  limiting  law 
enforcement  wiretapping  of  e-mail  to  investigations  of  serious  crimes 
and  requiring  top-level  Justice  Department  authorization  of  e-mail 


f rom  our  archive: 


frRsrip  reviewing  FBI’s  Net 
pqretap’  system 


S/24/02  Release  - Page  5^8 
7/24/00  11:31  AM 


on 


FBI:  ‘Carnivore*  will  play  nice 


Shareware  Shelf 
Web  Potholes 
Web  Resources 
Consumer  Sites 
Tech  Front 

Marketplace 

Hardware 

Accessories 

Software 

Print  Edition 
Today 


Subscribe 

Archive 


find  books 

up  to  50%  off! 


Resources 

E-mail 


Feedback 
About  us 
dobs  at  USA 
TODAY 

Free  premiums 

USA  TODAY 
Update 
Software 


rawr 

.com  |i 

Users!  fS 


1 /v>w, 


usatoday.com/ljfe/cyber/tecWc 


bugging.  Under  proposed  legislation,  die  procedures  for  e-mail 
surveillance  would  be  similar  to  those  in  place  for  telephone 
surveillance. 

Court  order 
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Inten?et  “mPanies  generally  let  FBI  officials  who  come 
said  °ff  s momtor  ibs  companies’  Internet  messages,  FBI  officials 

Tbe  FBI  said  it's  looking  for  two  academic  institutions  to  serve  as 

t0  r t0  emUre  th-e  doesn*£  overreach  authority  and 
pry  mto  the  online  communications  of  the  general  public  . * 
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, servers  of  internet  companies  to  weed  out  messages  sent  and 
received  by  people  unconnected  to  the  investigation,  officials  said 
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Watts:  FBI’s  ‘Carnivore’  System 
a Dangerous  Invasion  of  Privacy 

Calls  on  Clinton-Gore  Administration  to  Suspend  New  Surveillance  Program 

WASHINGTON  - Rep.  J.C.  Watts,  Jr.  (R-OK),  Chairman  of  the  House  Republican  Conference 
and  House  Republican  Cyber-Security  Team,  issued  the  following  statement  today  on  the  FBI’s 
‘‘Carnivore*’  system  at  a Capitol  Hill  hearing; 

nve  need  innovative,  new  law  enforcement  strategies  to  combat  the  real  and  growing  threat  of 
cyber-crime.  U.S.  law  enforcement  needs  to  focus  resources  on  the  training  and  expertise 
necessary'  to  protect  our  cyber-security,  1 remain  committed  to  working  in  Congress  to 
adequately  invest  in  and  support  the  right  law  enforcement  tactics. 

“However,  the  FBI’s  ‘Carnivore’  program  represents  a dangerous  and  unprecedented  invasion  of 
online  privacy.  Despite  repeated  inquiries,  the  Clinton-Core  Administration  continues  to  offer 
only  vague  responses  and  little  enlightenment. 

The  FBI  s record  on  protecting  privacy  is  also  problematic.  From  unwarranted  wiretaps  to  its 
mishandling  oi  hundreds  of  files  on  political  appointees  just  a lew  years  ago,  there  is  ample 
cause  for  concern. 

“Before  we  impose  privacy  restrictions  on  the  commercial  industry,  it  seems  the  federal 
government  has  a duty  and  an  obligation  to  honor  the  privacy  of  the  people  it  has  sworn  to 
protect.  I commend  Chairman  Canady  for  highlighting  this  egregious  threat  to  the  online  privacy 
of  every  American  .” 
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FROM; 

OM6  CONTACT; 


SUBJECT; 

DEADLINE; 


EXECUTIVE  OFFICE  OF  THE  PRESIDENT 
OFFICE  OF  MANAGEMENT  AND  BUDGET 
Wash*  ns  ten,  D.C.  20£D3^J0at 

Tuesday,  February  29, 2090 

tESiSUTWE  REFSRRA L MEMORANDUM 

L&gisisc-ve  Usison  Cffesr  - Sea  Distribution  beiow 

(fer)  Assistant  Director  for  iBgislakVa  Reference 

1 Mai  1 1 1 ecp.ci  ii 

phc^hb  mmm 

Cm  Request  for  Viaw*  on  S2D92HSghTecri  Crime  Bill 
Wednesday,  March  3, 20C0 


/ff- 


tn  accordance  wifr  CMS  Circular  A.  19,  OMB  requests  the  views  cf  ycur  agency  on  the  s^cve  ™>nVr» 

•ffSSnS"8  B°5  'SkliOMWjj  b the  program  of  ihe  President  Pleas*  3<tWs*  us  if  tfcL  Lm'will 

r T^dfnS  °f  rec^  iQr  l»*pc*w  * «*  M^y*As.You^o-  provisions £™?££ of 
trie  Omnibu*  Budget  ReeoncSiatJon  Act  of  tm  P T'8  *II!  of 

COMMENTS;  A copy  of  S,  2592  Is  attached. 

Jttsrtica:  Please  advise  of  any  plans  to  prepare  a views  letter  ©n*$.  2092. 

DiSTRIBUTICM  t Jgy 
AGENCIES: 

fi!~JUSTIC£  - Robert  Raben  ♦ £232}  5)4*2141 

1£*  TATE  -Pmi  ntOmtdm  .{{Q7) 

^TOE,-£NS5  - Samuef  7.  Snot  it.  - (7033  637-1305 
.It.'  R6A5URY  - Richard  S.  Carrs  - {202}  S22-GS5C 
^-COMMERCE  * Michael  A.  tsvstt  - (202}  432-3151 

i«f?-n’unta3acm  Commission  - Shsryl  Wilkerscn  * (202}  41 3-1  SCO 

"^iRune®  Agency  - Cynthia  0.  Ensfcna  - (7C3)  482-0825 
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CONGRESSIONAL  RECOJRB — SENATE 


February  24,  2000 


non  6 ilfoKlj  of  such  Codo  1$ 

^ oy  inserting  "{th«  toe  of  the  tract- 
m<t\<  sf  the  American  Transport  Reecv* 
efy  Act  loca,  in  the  ease  <f  sfttsel  fuel)" 
aft*r  "October  U ZW&"  both  pUca  ft  ap* 

pftaCSr. 

JB)  fay  inserting  "(the  to*  which  U S 
months  after  the  date  of  the  mactment  of 
such  Act,  in  the  ease  af  dftset  fueO  after 
"March  3i.  im"  both  ftota  it  appears,  and 
tC}  by  inserting  "(tfa*  to*  which  ft  3 
months  after  the  date  of  the  enactment  of 
such  Act,  in  the  cast  of  diewi  fuel}  after 
‘Uanu&ry  i* 

(4)  Sootinn  f42?ffM$  a/  such  Code  is 
ed  fay  inserting  ''(during  the  1 year  period  fa*N 
ginning  on  the  date  of  the  enactment  of  the 
American  Transportation  Recovery  Act  of 
tm,  in  the  case  sf  dftael  ftrilT  After  "Sep- 
tember 30.  20OT\ 
fr)  effective  Date.— 

0)  Jh  cefJEJUL.-Exeepa  as  provided  in 
paragraph  €?)„  the  amendments  made  fay  this 
section  shall  take  effect  on  the  date  of  she 
tnactmcnt  of  this  section, 

0 DeCREASE  IN  QlUDS  Oil  Fmcsi— If  she 
Secretary  of  Treasury  determines  that  the 
average  refiner  acquisition  costa  Ear  crude 
oil  are  equal  to  or  less  thin  such  costs  were 
on  December  3J,  ipst,  the  amendments  made 
fay  this  section  shall  tease  to  tafca  effect  and 
the  Intemai  Revenue  Code  shall  be  tordoft- 
ter^d  £3  if  such  amendments  did  nee  uke  ef- 
feet. 

By  Mrs,  FEIMSTEIH: 

S,  20$ i.  A bill  to  amend  the  Act  that 
author*****  construction  of  the  San 
Luis  Unit  of  the  Central  V&Iiey 
Project,  California,  to  fecititatc  water 
transfers  in  tha  Central  Vadky  Project; 
to  the  Committee  on  Energy  and  Nat- 
ural Resources. 

CCNSTRUenSN  OF  THt  $AN  U*T$  tlW?  OF 

THE  central  VALLEY  PROJECTS 

Mrs.  FEIN  STEIN,  Mr,  Pratident* 
today  I Introduce  a bill  to  amend  the 
legislation  that  authorised  comtruc- 
ticn  of  the  San  Luis  Unit  of  the  Cen- 
tral Valley  Project  In  California,  En- 
actment of  this  bill  would  allow  water 
districts  in  the  San  Luis  Unit  of  the 
Central  Valley  Project  to  supplement 
their  fedejnl  water  supplies  with  pur- 
chases of  water  from  the  State  Water 
Project.  At  present,  federal  law  pro- 
hibits the  delivery  of  non-federal  water 
ro  districts  In  the  San  Luis  Unit  until 
certain  conditions  are  met. 

The  Sen  Luis  Unit  is  the  last  compo- 
nent created  by  federal  law  in  the  Cen- 
tra! Valley  Project,  which  Is  ths  larg- 
— purcuu  M prejset  in 

the  United  Starts.  Water  service  to  dis- 
tricts in  the  San  Luis  Unit  is  often  cur- 
tailed because  of  limitations  imposed 
in  pumping  In  the  Sacramento- S&n 
J coquin  Delta. 

It  is  customary  for  water  districts  in 
the  San  Luts  Unit  to  supplement  their 
supplies  through  purchases  m the  open 
market.  However,  current  federal  law 
prohibits  them  from  purchasing  sup- 
phes  from  the  State  Water  Project  and 
having  chase  delivered  over  federal  fe- 
ci liters.  Making  such  deliveries  is  rel- 
atively eesy  because  state  and  federal 
project  conveyance  facilities  are  inter  - 
connected.  Prohibiting  purchase  . of 
state  water  for  deliver/  over  federal  fa- 
Cilices  Umics  the  opportunities  ovaih 


able  for  San  Luis  Unit  districts  to  ob- 
tain as  large  a supplemental  supply  as 
they  would  like. 

Mr.  President,  this  bill  has  already 
passed  the  House  as  H.R.  3077,  U will 
Impose  no  additional  costs  on  the  fed- 
eral government.  It  contains  provisions 
which  assure  that  the  additional  water 
obtained  fay  districts  in  the  San  Luis 
Unit  cannot  be  used  in  a manner  that 
would  exacerbate  current  groundwater 

drainage  problems*  It  is  consistent 
with  the  provisions  in  the  Central  Val- 
ley Project  Improvement  Act  that 
sought  to  encourage  the  exchange  of 
water  by  willing  sellers  to  provide  ad- 
ditional supplies  at  reasonable  case  to 
willing  buyers.  I urge  the  Senate  to 
pass  this  bllL 

By  Mr*  SCHUMER  (for  himself 
and  Mr.  KvQ: 

$*  2332,  A bill  to  amend  title  13> 
United  States  Code,  to  modify  authori- 
ties relating  to  the  use  of  pen  registers 
and  trap  and  trace  devices,  to  modify 
provLsiQns  relating  to  fraud  and  related 
activities  In  connection  with  com- 
puters* and  for  other  purposes:  to  the 
Committee  on  the  Judiciary, 

ttlCKTECK  OUMEBSJL 

Mr.  SCHUMER,  Mr,  President,  I riso 
today  to  introduce  with  my  friend  from 
Arftsma.  Senator  KVU  a high  tech 
crime  bill  aimed  at  combating  com- 
puter crime.  For  the  past  nine  months 
I have  been  discussing  with  law  en- 
forcement and  computer  crime  experts 
how  bast  to  address  the  growing  threat 
that  computer  crimes  pose  to  our  In* 
crtatingly  networked  society. 

Many  of  the  best  solutions  are  far* 
reaching  and  complex  and  will  only  ba 
achieved  through  sustained  and 
thoughtful  hard  work  on  m inter- 
national level  by  both  government  and 
the  private  sector  in  the  years  ahead. 
There  are,  However,  modes  changes  to 
existing  taws  that  can  be  made  now, 
which  will  serve  as  a significant  first 
step  In  a much- needed  effort  to  give 
law  enforcement  to  todh  they  need  to 
effectively  fight  cyberciime.  The  legis- 
lation that  Senator  XYt  and  I are  in- 
traducing  today  wiIL  among  other 
things,  make  the  following  changes  to 
existing  law. 

Wc  must  update  our  law?  governing 
the  use  of  what  art  called  pen  registers 
(which  record  The  numbers  dialed  on  a 
phone  line}  and  crap  and  croc*  devices 
(which  capture  incoming  eiecxrcmc  im- 
pulses that  identify  the  originating 
number}.  Theta  laws  have  become  out- 
dated and  their  procedures  are  too  slow 
for  the  speed  of  criminals  online. 

Under  currant  law.  investigators 
must  obtain  a trap  and  trace  order  in 
each  Jurisdiction  tlvough  which  an 
electronic  communication  is  made. 
Thus,  for  example,  to  trace  on  online 
communication  between  two  terrorists 
that  scares  at  a computer  in  New  York, 
goes  through  a server  in  New  Jersey* 
bounces  oil  a computer  In  Wiscomfn. 
and  then  ends  ;n  Son  Francisco,  ;nves* 
ti  go  tors  may  be  forced  xo  |C  suctss- 
lively  to  a court  in  2sch  j urixtiction 


for  an  order  permitting  the  trace  (not 
to  mention  having  to  approach  each 
provider  along  the  way).  In  the  reconc 
Denial  of  Sendee  attacks,  hackers  uti- 
Lced  doaem  or  even  hundreds  of  'Ydm* 
hit*  computers  from  which  the  attacks 
on  specific  sites  were  then  launched. 
No  doubt,  these  computers  were  1c- 
cat&d  all  over  the  country,  and  emcing 
them  quickly  under  current  law  ts 
therefore  virtually  Impostihle, 

This  legislation  will  amend  current 
law  to  author tze  the  issuance  of  a sin- 
gle order  to  completely  trace  an  online 
commurUcaticn  to  its  source,  regard- 
less of  how  many  intermediate  sites  It 
passes  through.  Law  enforcement  must 
still  meet  the  exact  same  burden  to  ob- 
tain such  an  order;  the  only  difference 
la  that  they  will  not  hove  to  repeat 
this  process  over  and  over  eech  time  a 
communication  passes  to  a new  csrrief 
in  a different  Jurisdiction, 

One  defttiency  of  the  Computer 
Fnaud  and  Abuse  Act*  U U.C,C,  1 1D3D.  is 
Its  requirement  of  proof  of  damages  in 
excess  of  SS.&02,  In  several  cases,  pros- 
ecutors have . found  that  while  com- 
puter intruders  had  attempted  to  harm 
computers  vital  to  our  critical  infra- 
structures, such  as  telecommuni- 
cations and  financial  services,  damages 
of  S 3,300  could  not  be  proven.  Neverthe- 
less, these  Incrusiom  pose  a great  risk 
of  harm  to  our  country  and  must  be 
prosecuted,  punished,  and  deterred. 

The  5chumer-Xyi  bill  will  unambig- 
uously permit-  federal  jurisdiction  at 
the  outset  of  an  unauthorised  intrusion 
into  critical  irvfrasmicture  systems 
rather  than  having  investigators  wait 
for  qny  damage  assessment.  Crimes 
that  exceed  the  $5,000  limit  will  be 
prosecuted  as  felonies*  while  crimes 
below  that  amount  will  be  defined  as 
misdemeanors.  The  bill  will  also  clar- 
ify that  a $5*000  loss  resuking  from  a 
computer  attack  may  include  the  costs 
of  responding  to  the  offense,  con- 
ducting a damage  assessment,  restore 
Ing  a syst&m  to  its  original  condition, 
and  any  lost  revenue  or  costs  incurred 
as  a result  of  an  interruption  in  serv- 
ice, The  $5*300  requirement  should  not 
Strve  as  a barrier  to  the  prosecution  of 
serious  computer  criminals  who  threat- 
en our  country's  networks. 

This  legislation  wtU  also  modify  a di- 
rective to  the  sentencing  commission 
contained  in  the  Antiterrorism  ond  Ef- 
fective Death  Ptn&lzy  Act  of  1SSL 
which  required  a mandatory  minimum 
sentence  of  six  months'  imprisonment 
for  certain  violations  of  section  1030, 
Computer  Intrusions  that  violate  the 
statute  vary  ;n  their  severity  or.d  mail- 
ciousness.  Ail  violations  should  be  pun- 
ished. but  under  the  current  regime  the 
mandatory  imprisonment  applies  to 
some  misdemeanor  charges,  even  where 
the  attack  caused  no  damoge.  As  a re- 
sult, some  prosecutors  hav*  declined  to 
bring  cases,  knewmg  that  the  result 
would  be  monastery  imprisonment.  Ws 
sheuid  Insure  that  federal  prcsecutcrt 
are  bringing  cotes  under  section  1333 
but  we  also  should  insure  that  the  sen- 
tences being  me:? b out  fit  the  crime. 
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nost  technologically  savvy  our  ml son,  ami  4vsry  federal  dollar  al-  Mr,  President*  since  l came  to  the 
^ are  juvenile*  who  have  located  for  Improving  this  situation  Senate  In  1SS3,  I've  worked  hard  to 
V?  with  computers  always  at  should  be  directed  to  our  nation's  In-  mote  economic  development  and  create 
-*r  fingertips,  unfortunately*  certain  dian  mr/s itinns.  The  lack  of  adequacy  n*w  *ob$  for  my  sxace  of  Hew  Mexico 
juvent.es  are  committing  the  most  sc*  roods  and  bridges  is  a chronic  problem  One  'thing  I learned  vm  auteklv  =< 
r-cus  computer  crimes  and  wreaking  on  Indian  reservations,  where  unem*  that  vou  can't  expect  to  ittret 
havoc  on  our  critical  infrastructures,  plcyment  averages  3S  percent  and  more  industry  unless  vou  have  the  bassr^T 

SV:a.tt  »£L$— — — sS&aSiSsSs 

s!lut  <s°wn  for  av*r  six  Stnce  ISSt  when  my  Senate  amend*  Infrastructure  needs  fnlwt  rXl.HZ 


CONGRESSIONAL  BJCOR0—  SENATE 


Juveniles 


caused  an  airport  In  Worcester,  Massa- 
chusetts to  shut  down  for  over  six 


Qown  jor  over  six  amci  isa*,  wnen  my  ben&ts  amend*  infrastructure  ^ 

hours  when  Sts  telecommunications  mem  added  Indian  roads  w our  federal  ration  power  colrmuni^tolf  u!P°r' 

conmetions  were  brought  down.  Simi-  highway  trust  fund  accounts,  all  funds  and  sew^ 

tarly,  cv^o  California  teenagers  broke  allocated  for  Indian  roads  ha^t  been  jces  at  ^fQrUahi*>  rAWM.  * ***** 

Into  sensitive  military  computers*  In-  used  for  chat  purpose,  in  t$TEAv  which  ^ create  rood  ieL  JSujS1**”  j** 
eluding  those  at  Lawrence  Livermore  preceded  the  enactment  of  the  Tram*  vekra,  ^ * bs  will  simply  not  de- 

National  Laboratory  and  the  U.$.  Air  parration  Efficiency  Ace  for  the  2lst  Today  our  cnunrrv  *< 

* iencer  term  *rrat«~  ^ Century  CTEWfi.  the  Indian  Reserve  have  one  of  the  strongest  economlw  in 
as  a !Cnger  term  strategy,  wonted  to  ticn  Roads  (IRR)  program  reached  a history  Our  rmm IJuJ..  . • ■ ’ m 

do  a better  job  of  teaching  wr  children  level  of  J»I  million  per  year.  aSoHkd  f T J°°  cr*' 

from  a very  young  age  that.  Ilk*  any-  Many  of  us  la  Oweress  worked  hard  olishment,  ofc  alco,?j 

where  else,  certain  conduct  on  the  to  Increase  this  IRR  funding  to  SltS  „ 1 U Amflcaf»  should 

Internet  Is  wrong  and  illegaL  But  we  million  in  the  first  year  of  TEA-2!  £FY  XT  *"•  ^fortunately,  as  many  of 
also  need  to  send  a clear  message  that  1 mi  and  ««  million  each  year  there-  ^2ZZ\T\  »«ow  «f  '***  "?tion 
crimes  on  the  Internet  will  have  real  after,  through  FY  2003.  Unfortunately.  * * iag,  b*hl,nd  **»  we  ec°- 

consequences.  This  legislation  will  a little  noticed  provision  for  Federal  ^ ' t**  ?**  "**<*  th* 

amend  IS  U.S.C.  SiS3a  t0  give  federal  Lands  Highways,  placing  an  “obliga*  XTr^*  f?  pfmculaf;  1 r*m»in  »»* 
law  emoreement  authorities  the  power  tion  limitation"  on  the  IRR  program,  TT  C Natlve  American 

to  investigate  and  prosecute  juvenilt  has  resulted  in  the  transit  of  funds  In-  f*^'  l'nemPlol'n'ent  rates 

offenders  of  computer  crimes  In  appro,  tended  for  Indian  reservations- to  be  ,,  J;  ” Country  frequently  top 

priate  oases.  The  bill  will  make  juve-  transferred  to  the  SG  states.  ’ 7'  * lm  evan  50  P*««ac-Mr.  Presj. 

ni.es  fifteen  years  of  age  or  older  who  In  FY  1138,  the  amount  deducted  for  . r*f,  nation  must  not  stand  by 
commit  the  most  serious  violation  of  this  transfer  m stats*  from  the  IRR  Country  is  literally  being 

section  1336  eligible  for  federal  prsstm*  program  was  520  million.  In  FY  15S5,  ie*f  behirt<i*  Perhaps  more  than  any  - 
tion  in  c^es  where  the  Attorney  G$a-  it  was  $3 U million;  and  In  FY  2000,  the  25^5 r community  in  America,  the 
eral  certifies  that  such  prosecution  {*  obligation  limitation  resulted  In  a loss  Jn™  A^ka  Native  Villages  suf- 
appropriate.  In  conjunction  with  the  af  W-3  million  that  could  have  been  reU?m  inadequate  infrastruorure* 


section  1030  eligible  for  federal  prostcu* 
tian  m ccs*es  where  the  Attorney  Can* 
era*  certUie*  that  such  prosecution  is 
appropriate.  In  conjunction  with  the 
elimination  of  the  six-month  moods- 


used  for  Indian  reservation  road  build- 


Thi*  y*ar  I am  pleased  to  be  working 
with  President  Clinton,  Senators 


tory  minimum,  this  legislation  will  Clinton,  Senators 

provice  a balanced  measured  approach  all  previous  enacting  legislation  wmemcj,  and  others  on  a 

to  juvenile  hacking  crime*,  since  mi,  federal  funds  Intended  for  w new  pregrams  and  initia- 

Again,  these  are  just  the  first  steps  programs  have  been  used  for  IRR  iiVs5  co  help  the  Native  American 
that  should  be  taken  in  a very  long  purposes.  Only  in  TEA-21  was  this  Communities  enjoy  the  same  love!  of 
battle  against  cy'bef  trime  that  many  ei  changed  due  to  the  application  of  the  ^C0nQ^^c  prosperity  as  the  rest  of 
us  will  wage  for  years  to  come.  And  obligation  limitation  to  Federal  Lands  resP^£ L the  Tribe*  are 

while  we  fight  computer  cHme  bv  Highways  and  the  IRR  ? regram.  no  difTereot  than  the  rest  of  America^ 


while  we  fight  computer  cHme  bv  Highways  and  the  IRR  program  no  different  than  the  rest  of  America—* 

modifying  our  criminal  laws,  we  also  bill  will  simply  exefude  th’e  IRR  promote  their  economic  develop- 

should  seek  concomitant  way*  to  fully  P^fram  from  this  annual  deduction  pcnc  bq&lc  infrastructure  must  First  be 
protect  the  fundamental  rights  of  lr.no-  ha*  totaled,  in  the  pest  three  in  P^ce,  The  President's  initiative  rec- 
cent  individuals  on  the  Internet,  years,  more  than  5S0  million.  This  ogoites  this  fact.  The  bill  we  are  intro- 

1 want  to  thank  Senator  Kyl  for  join-  momy,  while  helpful  to  many  state*,  is  ^u^ng  today  addresses  one  element  of 
ing  me  in  introducing  this  bill.  As  more  badly  needed  on  Indian  reserva*  ^hat  initiative — the  need  for  basic 
cheJrmajn  of  the  Subcommittee  on  tions  and  should  be  preserved  for  that  transportation,  including  road*  and 
Technology,  Terrorism,  and  Cavern-  purpose.  By  excluding  the  IRR  program  transit.  This  hill  will  help  promote 


chelrowi  of  the  Subcommittee  on  tions  and  should  be  preserved  for  thai 
Technology,  Terrorism,  and  Covem-  purpose.  By  excluding  the  IRR  ptogjarr 
ment  Information,  l know  that  he  From  this  obligation  limitation  provl 
cart*  deeply  about  these  Issues  and  I sim  we  will  be  increasing  federa 
look  forward  to  working  with  him  m fund*  for  Indian  road*  without  Increas 
this  cemmomemet  bipartisan  leg isla-  ing  the  cost  of  the  total  program,  W< 


and  Mr. 


from  this  obligation  limitation  provl-  transportation  on  mtt y reservation  In 
sioa  we  will  be  increasing  federal  America  by  fully  funding  the  Indian 
fund*  for  Indian  road*  without  Increas-  Rflservac ion  Roads  Program, 
log  the  cost  of  the  total  program.  We  ^irst  estabUshed  in  1 m the  Indian 
will  be  focusing  the  fund*  for  Indian  Reservation  Roads  program  is  one  of 
u \ * ^ s „ roods  on  Indian  roads,  as  we  have  in-  the  ways  America  meets  its  special  re- 

, ^or.  tended  since  iht  IRR  program  first  he-  sponsibmty  to  help  Motive  Americans 


carr ? sf  cur  federal  highway  trust  3chie-/e  saif  sufficiency  and  self  dec? 


minatiom  The  goal  of  Indian 
ervation  Road*  prog  ram  i$  to  provide 


; curcosev 


Over  the  years,  the  program  ha*  bee 


« +«*+rLn  , . _ f««d  In  mlimiom  The  goal  of  Indian  Rss- 

v Tt  /v.ai  the  Transpor-  I urge  my  colleagues  to  join  us  in  re-  ervatioti  Roads  pregram  i$  to  provide 

tst*on  equity  Act  for  the  2 1st  Canter/  directing  funds  intended  for  Indian  cafe  and  economic  me&ns  of  tra«ueor* 
to  incurs  that  ,uil  obligation  author, ty  mad  construction  to  be  dedicated  to  "zzion  throughout  Indian  Country. 
^ for  the  Indian  reseda  tier  that  purpose  * Over  the  years,  the  program  ho*  been 

roads  program;  to  the  Committee  on  Mr.  S INCAM  AN.  Mr.  President,  I am  rtmtho^d  and  modified  to  help  meet 

r*«viror.menc  and  RubUc  Works,  pleased  to  join  today  with  my  scod  the  Tribes’  needs  for  baulc  transport 

SCVrrv  act  fc«  ms  :*5T  friend  and  colleague  from  Mew  Mexico,  totion  infrastructure.  Most  recentiv, 

. w * lf!5rc^c^  :he  program  was  reauthom^d  for  six 

M.  yX'  ^wNfE.4lU-  Mr.  President,  I om  bill  along  mth  Senator  BalCLS,  This  years  in  im.  The  program  is  playing  6 

Jy  my  <st*  MU  assure  stos  curyM  AawkM  critical  rote  in  ecinoroic  dev*iow»««t. 

*****  3ac*  eonfsw?tJ<*  hav*  ih®  fewSS«8  «^y  s^if-dcter.Tiirwcion.  and  ^otpiovroertt  ci 
:;l:  ksistocon  «>  Pf"'  oe4frf  fe£  tip81,,  Nativa  Amsrlcafis  in  33  states.  IncSurf* 

r^,ous  ooUar*  oOocuted  by  the  project*,  uur  bill  ^il  fund  the  Indian  the  Alaska  Native  Villages 

tne  President  hr  con-  Reservation  R^sad  Program  for  the  mxs  Currency,  the  r^ervatioo  rood*  *ys- 
tt£»ict:an  cf  Indu-in  rtsor/atloa  roods.  three  years  with  *r  least  iVS  rmliion  t«m  comersse*  $$  tro  nf  a?A-  and 


Mr*  B INC  AM  AN.  Mr.  President,  I am  reauthorized  and  modified  to  help  meet 
pleased  to  join  today  with  mv  good  the  Tribes’  needs  for  baulc  transport 
friend  ana  colleague  from  New  Mexico,  tstion  infrastructure  Most  recent lv 


.augues  Jeff  Bincaman  and  Max  Sac- 
vV*  m Introducing  kgiskeon  to  pre- 
jfr  - Pilous  dollars  allocated  by  the 
uengrass  and  the  President  for  con- 
struct: sn  cf  Indian  r*cer/atlon  roods. 


suet  that  Indian  r**-  p«r  veor.  the  full  3m cunt  authors 


e th«y  self-determination,  and  employment  of 

^transportation  Native  Americans  in  33  stats*,  Includ- 
,und  L.e  Indian  mg  the  Alaska  Native  Villages, 
ram  ;cr  the  next  Currently,  the  reservation  road*  sys- 
nst  12“!  rmlUon  tem  comprise*  2£JC8  miles  of  3LA-  ond 
ot  author ued  by  Tfib^j-owned  roads  and  2S,B0O  mile*  of 
stats,  counsy  end  local  roods.  Titer* 
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(1)  by  inserting  “or  trap  and  trace  device5' 
after  “pen  register’,* 

(2)  by  msernng  routing,  addressing.”  after 
“dialing”;  and 

' (3)  by  striking’ “call  processing”  and  inserting 

“the  processing  and  transmitting  of  wire  and  elec- 
tronic communications”- 
fb)  ISSTAh'CS  OF  OeBBSS.— 

(1)  In  gsxfPvAL.— Subsection  {a}  of  section 
3123  o:  that  tide  is  amended  to  read  as  follows: 

-'•(a)  U?  GsNSRai.— (1)  Upon  an  application  made 
under  section  3122(a)(1)  of  this  title,  the  court  shall  enter 
an  ex  parte  order  authorising  the  installation  and  use  of 
a pen  register  or  trap  and  trace  de-ice  if  the  court  Suds 
that  the  attorney  for  the  Government  has  certified  to  the 
court  that  the  information  likely  to  be  obtained  by  such 
installation  and  use  is  relevant  to  an  ongoing  criminal  in- 
vestigation. The  order  shall,  upon  service  or  the  order, 
apply  to  any  entity*  providing  ■wire  or  electronic  corrunu- 
mcafcon  service  xn  use  u *nce cx  aitu^-s  tvx-oss  »-we  -a 

required  to  effectuate  he  order. 

w(2)  upon  an  application  made  under  section. 
3122(a)(2)  of  this  tide,  the  court  shall  enter  an  ex  parte 
order  authorizing  the  installation.  and use  of  a pan  register 
or  nrao  and  mace  deuce  within  the  jurisdiedon,  of  the  court 
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1 

if  th. 6 court  finds  th&t  6 St&ts  Isw  sTHorcsmcnt  or  *nv€$* 

2 

tigativa  officer  hss  cerdfiad  to  the  court  that  tns 

3 

lion  likely  to  be  obtained  % such  installation  and  use  is 

4 

relevant  to  an  ongoing  criminal  m-vestigatiorL”. 

5 

(2)  Contents  of  okdse.— Subsection  (b)(1) 

6 

of  that  section  is  amended— 

1 

(A)  in  subparagraph  (A)— 

E 

(i)  by  inserting  “or  other  facility” 

9 

after  “telephone  line”;  and 

10 

(ii)  by  inserting  before  the  semicolon 

n 

at  the  end  “car  applied”;  and 

12 

(B)  by  striking  subparagraph  (C)  and  in* 

13 

setting-  the  following  new  subparagraph  (C): 

14 

“(C)  a description  or  the  communications 

15 

to  which  the  order  applies,  including  the  mem- 

16 

ber  or  other  identifier  and,  if  known,  the  loca- 

17 

tion  of  the  telephone  line  or  other  facility  to 

18 

which  the  pea  register  or  trap  and  trace  device 

19 

is  to  be  attached  or  applied,  and,  in  the  case  of 

20 

* - — order  auct*om.mg  — — 

Jit 

21 

trap  and  trace  device  under  subsection  (a)(2), 

22 

hoc  geographic  limits  of  the  order,  and”. 

* * 

(3)  MONBJSChOSUES  BSQTIBSOSNTS. — Sub- 

24 

section  (d)(2)  of  that  section  is  amended— 

2jOQ6 
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10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
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(A)  by  inserting  “or  other  faculty’  after 
“the  lice”;  and 

(B)  by  striking  “or  v?ko  has  been  ordered 
by  the  coon”  and  inserting  “or  applied  or  who 
is  obligated  by  the  order51-. 

(c)  BMER&ENC7  INSTALLATION. — Section 

> 125(a)(1)  o£  that  title  is  amended — 

{1}  in  subparagraph  (A),  by  striking  “or”  at 
the  end; 

(2)  in  subparagraph  (B),  by  striking  the  comma 
at  the  end  and  ins  erring  a semicolon;  and 

{3}  by  inserting  after  subparagraph  (B)  the  fol- 
lowing new  subparagraphs: 

“{€)  immediate  threat  to  the  national  se- 
curity interests  of  the  United  States; 

“(D)  immediate  threat  to  public  health  or 
safety  or 

“(B)  an  attack  on  the  integrity  or  avail- 
ability of  a protected  computer  which  attack 
w»la  be  an  crfense  puaishabla  under  rcriicu 
1030(e)(2)(C)  of  this  title/5. 

(d>  B-HNI7I0NS.™ 

{1}  COUKT  OF  CONPLTLNT " • JURISDICTION. — 


24 


Paragraph  (2)  of  section  3127  of , that  title 


if  oor 

iJOOS 
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5 

6 

7 

8 

9 

10 


12 

13 

14 

15 

16 

17 

18 

19 

20 
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22 


24 


amended  by  striking  subparagraph  (A)  ana.  inserting 
the  following  new  subparagraph  (A): 

“(A)  any  district  court  of  the  United 
States  {including  a magistrate  judge  of  such  a 
court)  or  any ’United  Stiles  Court  of  Appeals 


having  jurisdiction  over  the  offense  being  inves- 
tigated; or”. 

(2)  Pen  segistee.— Paragraph  (3)  of  that  sec- 
tion is  amended— 

(A)  by  striking  “electronic  or  other  im- 
pulses” and  all  that  follows  through  “is  at- 
tached” and  inserting  “dialing,  routing,  ad- 
dressing, or  signalling  information  transmitted 
by  an  instalment  or  facility  from  which  a wire 
or  electronic  communication  is  transmitted”; 


(B)  by  msertmg  “or  process”  after  “de- 
vice” each  place  h appears. 

(3)  Thu?  i>m  T2tiC3  DEVICE.— Paragraph  (4) 
o:  that  section  :s  amended — 

(A)  by  inserting  “or  process”  after  “a  de- 
vice” ; and 

(3)  by  striking  “of  an  instrument*’  and  all 
that  follows  through  the  end  and  inserting  “or 
other  eiriirr,  routing,  addressing,  and  signsi- 
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1 Hng  information  relevant  to  identifying  die 

2 source  ot  2 ndre  or  electronic  communication,  . 

3 $EC.  2.  MODIFICATION  OF  PROVISIONS  RELATING  TO 

4 FRAUD  AND  RELATED  ACTIVITY'  IN  CONNEC- 

5 TION  WITH  COMPUTERS. 

6 (a)  Penalties.— Subsection  (c)  of  section  X030  of 

7 title  IS,  United  States  Code,  is  amended— 

8 (1)  in  paragraph  (2}-~ 

9 (A)  in  subparagraph  (A) — 

IQ  (i)  by  inserting  “except  ss  provided  in 

11  subparagraphs  (B)  and  (€),“  before  “a 

12  fine"; 

13  (il)  by  striding  ‘'(a)(S)(C}/!  and  in- 

14  setting  “(a)(5), ! and 

15  (iii)  by  striking  “and"  at  the  end; 

16  (B)  in  subparagraph  (B)— 

17  (j)  by  inserting  “or  an  attempt  to 

18  commit  an  offense  punishable  under  this 

19  subparagraph,"  after  “subsection  (a)(2)," 


m tse  matter  pmeecng  clause  y..;  :n,. 

(*i)  by  adding  “and*’  at  the  end:  and 
(G)  by  striking  subparagraph  (0)  and  in- 
serting the  following  new  subparagraph  (C): 


<itr\  a 


under  this  title  or  imuriscnment  for 


>t  more  rbo-  10  years,  or  both,  in  the  case  of  an 
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I 

offense  under  subsection  {a)(5  j(A)  or  (2,)(o)(B),  or 

2 

an  attempt  to  commit  an  offense  punishable  under 

3 

this  subparagraph,  is  the  offense  caused  (or,  in  the 

4 

ease  of  an  attempted  offense,  would,  if  completed. 

5 

'have  caused) — 

6 

«(i)  loss  to  one  ox  more  persons  during  any 

7 

one-year  period  (including  loss  resulting  from  a 

3 

related  course  of  conduct  affecting  one  or  more 

9 

other  protected  computers)  aggregating  at  least 

10 

$5,000  in  value; 

a 

“(ii)  the  modirication  or  inpayment,  or 

12 

potential  modification  or  impairment,  of  the 

13 

medical  eiamxcahon,  diagnosis,  treatment,  or 

14 

care  of  one  or  more  incividusls: 

15 

“(iii)  physical  injury  to  any  person.; 

16 

«(jv)  a threat  to  public  health  or  safety;  or 

17 

"(v)  damage  affecting  a computer  system 

18 

used  by  or  for  a government  entity  m further- 

19 

ance  of  the  admirisiratiou  of  justice,  national 

20 

defense,  or  zsdonzi  securing  and”; 

21 

(2)  by  redesignating  subparagraph  (B)  of  para- 

, y 

22 

graph  (3)  as  paragraph  (4); 

■r\*> 

/ 

(3)  m paragraph  (3) — 

74 

(A)  by  striking  “(A)”  at  the  beginning; 

25 

and  j 

5/24/02  Release  - Fad 


- 

Oj/23/8Q  }{0X  10:57 

*02/22/00  14:2$  P.U 

FAX  202  fy|  339$  OLUDOJ  f-  fgl 

scdmm  

0:VAKJi\ABMOO.j 

SX.C. 

.IS 

S 

(3)  by  striking  ",  (a)(5)(A),  (a)(5)(B) /’.; 

* t 

1 

X. 

1 

** 

D 

ana 

(4)  3 paragraph  (4),  as  designated  by  para- 

4 

graph  (2)  of  this  subsection,  by  striking  “(a)(4), 

5' 

'(a)(5)(A),  (a)(5)(B),  (a)(5)(C)/’  and  inserting 

6 

“(a)(2),  (a)(3),  (a)(4),  (a)(6)/’. 

7 

(b)  Definitions. — Subsection  (e)  of  that  section  is 

g 

amended-- 

9 

(1)  m paragraph  (2)(B),  by  inserting  imelud- 

10 

ing  a ccmpoter  located  outside  the  United  States” 

11 

before  the  semicolon; 

12 

(2)  in  paragraph  (7),  by  striking  “and”  at  the 

13 

end; 

14 

V 

(3)  by  striking  paragraph  (S)  and  inserting  the 

15 

foUovring  paragraph  (o): 

16 

“(S)  fee  term  ‘damage’  means  any  impairment 

17 

to  the  integrity  or  avahabCity  of  data,  a program,  a 

IS 

system,  or  information/’; 

19 

(4)  in  paragraph  (9),  by  striking  the  period  at 

20 

the  end  &a  'inserting  ; anc* ; ana 

21 

(5)  by  adding  at  the  end  the  following  new 

yj 

paragraphs: 

23 

«n0)  fee  term  ‘conviction’  shall  include  an  ad- 

24 

judication  of  iuvsnite  delinquency  for. a violation  of 

25 

Sou 

docs 
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1 "(ll)  the  term  loss’  means  any  reasonable  cost 

2 to  any  victim,  including  the  cost  of  responding  to  an 

3 offense,  conducting  a damage  assessment,  and  re- 

4 storing  the  data,  program,  system,  or  information  to 

5  its  condition  prior 'to  the  offense,  and  any  revenue 

6 lost  or  cost  incurred  because  of  interruption  of  serv- 


7 ice.". 

8 (a)  IXcos BS  IK  Civil  Acno?^,— Subsection  (g)  of 

9 that  section  is  amended  in  the  second  sentence  by  striking 
10  “involving  damage”  and  all  that  Mows  through  the  pe- 
ll riod  and  inserting  “of  suoseetion  (a}(o)  shah  be  limned 

12  to  loss  unless  such  action  includes  one  of  the  elements  set 

13  forth  in  clauses  (ii)  through  (v)  of  subsection  (c)(2)(C)”- 

14  (a)  CBDGKAL  ?CEFSrnJKS,— That  section  is  farther 

15  amended  by  adding  at  the  end  the  following  new  sub- 


16  section: 

17  The  court,  in  imposing  sentence  on  any  person 
I B convicted  of  a violator  of  this  section,  shall  order,  in  addi- 

19  tion  to  any  other  sentence  imposed  and  irrespective  of  any 

20  provision  of  Stats  law,  that  sucn  p&rocr.  r oners  tr  an  2 


21  United  States — 

22  “(A)  the  interest  of  such  person  in  any  prop- 

23  eny,  whether  real  or  personal,  that  was  used  or  in- 

24  tended  to  be  used  to  commit  or  to  facilitate  the  coxn- 

25  mission  of  sum  uoia*;orr  ar.d 


3§<12 

®cio 
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"(B)  any  property,  whether  reel  or  personal. 
coRstimmif  or  derived  from  my  proceeds  that  suer 
person  obtained,  whether  directly  or  indirectly,  as  a 
resuit  or  such  riolanon. 

...  “(2)  The  criminal  .forfeiture  of  property  -under  this 
subsection,  any  seizure  and  disposition  thereof,  and  any 
administrative  or  judicial  proceeding  relating  thereto,  shall 
be  governed  by  the  provisions  of  section  413  of  the  Con- 
trolled Substances  Act  {21  U.S.C.  853},  except  subsection 
(d)  of  that  section.”. 

{e}  Crm  FoEjEITUSS. — That  section,  as  amended 
by  subsection  (a)  of  this  section,  is  farther  amended  by 
adding  at  the  end  the  fohowxng  new  subsection: 

**{j){l)  The  following  shall  be  subject  to  forfeiture  to 
the  United  States,  and  no  property  right  shall  exist  In 


“(A)  Any  property,  whether  real  or  personal, 
that  is  used  or  intended  to  be  used  to  commit  or  to 
facilitate  the  commission  of  any  violation  of  this  sec- 


“(B)  Any  property  whether  res 


OV**v**j 


that  institutes  or  is  cer.vea  from  proceeds  traos 
able  to  anv  rioisdor.  of'fhis  section 
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1 “(2)  The  pwwsioas  of  chapter  48  of  this  uxle  relating 

2 to  civil  forfeiture  shall  apply  to  any  seizure  or  chfl  for* 

3 feiture  under  this  subsection.'". 

4 SEC,  3.  JUVENILE  DELINQUENCY. 

5 - Qanse  (3)  of  the  Srsi  paragraph  of  section  5032  of 

6 title  IS,  United  States  Code,  is  amended — 

7 {1}  by  striking'  ‘"or”  before  “section  1002(a)’5; 

8 (2)  by  striking  “or”  before  "section  324(b)”; 

9 and 

10  (3)  by  inserting  after  ""or  (h)  of  this  title,”  the 

11  rbdouing:  "or  section.  1030(a)(1),  {a)(2)(B}:  or 

12  (a)(3)  of  this  title,  or  is  a felony  ■violation  of  section 

13  1030(a)(5)  of  this  title  where  such  violation  ox  such 

14  section  1030(a5(5)  is  punishable  under  clauses  (2) 

15  through  (v)  of  section  1030(e)(5)(C)  of  this  title,”. 

1 6 SEC.  4,  AMENDMENT  TO  SENTENCING  GUIDELINES. 

17  Section  805(e)  of  the  Antiterronsm  and  Effective 

18  Death  Penalty  Act  of  1938  (Public  Law  1(54-132;  28 

19  U.S.C.  994  note)  is  amended  by  striking  "paragraph.  (4) 

20  cr  (5}“  and  inscrdag  "paragraph  (1)  cr  a filer.;*  \f 

2 1 of  paragraph  (5) ( A) ” . 
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Mr.  Parkinson: 


i) 


May  4,  2000 


Re:  HiGH  TECH  CRIME  LEGISLATION 

TLU  LEGISLATIVE  PROPOSALS 


' ' This  is  to  alert  you  to  the  on-going  efforts  of  the  Technology  Law 

Unit  in  assisting  OPCA  in  addressing  the  FBI's  criminal  legislative  needs  relating  to 
computer  and  Internet  investigations  as  well  as  responding  to  issues  generated  by 
various  legislative  proposals  being  submitted  by  members  of  Congress. 

Attached  are  a series  of  documents  which  may  be  broken  down 
into  two  (2)  groups:  1 ) Amendments  (with  legal  analysis)  which  the  FBI  supports  to 
existing  bills  currently  filed  and  under  consideration,  and;  2)  Proposed  amendments  the 
subject  matter  of  which  is  not  currently  proposed  bill  Some  significant  portions  of  these 

materials  represent  adaptations  of  proposals  we  support  and  which  have  been  - — 

hammered  out  with  CCIPS  over  the  past  several  months.  We  understand  from  CCIPS 
that  most  of  these  proposals  have  been  approved  by  the  administration  to  be  “shopped 
around"  and  CCIPS  is  generally  aware  of  our  providing  technical  drafting  assistance  and 
commentary  to  the  staffs  of  members  of  Congress.  This  has  been  a time-intensive 
process  which  has  absorbed  significant  TLU  resources  with  regular  assistance  from  1LU 
. and  is  expected  to  continue  until  the  end  of  the  current  legislative  session. 


In  addition,  this  is  to  alert  you  that  TLU’sl^^^^^_„, 
ril!  be  accompanying  OPCA  on  Thursday,  May  4,  2000  and  Friday 
to  meet  with  Senator  Hatch's  staff  and  Senator  DeWine's  staff  regarding  high  tech 
issues  and  FCC  merger  approval  deadline  issues  (S.467)  respectively. 


Patrick  W.  Kelley 
Deputy  General  Counsel 


1 * Mr.  Collinowood 
1 


1 - Mr.  Stei 
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PRIORITY  OF  MATTERS  CONTAINED 
IN  BELLS  CURRENTLY  UNDER  CONSIDERATION. 


1)  Support  funding  for  Technical  Support  Center  and  Regional  Computer  Forensic 
Laboratories.  (Hatch) 

2)  “Tweaking’"'  of  language  in  the  amending  Pen  Register/Trap  and  Trace  Statute, 
(Kyl/Schumer) 

3)  ' “Tweaking”  of  language  amending  the  Computer  Fraud  Statute. " 

(Kyl/Schumer  and  Hatch) 

4)  Oppose  Expansion  of  Secret  Service  18  U.S.C,  §1030  jurisdiction.  (Hatch) 


l 
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Support  funding  for  Technical  Support  Center  and  Regional 
Computer  Forensic  Laboratories 


1 
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MATTER  CONTAINED 

IN  BILLS  CURRENTLY  UNDER  CONSIDERATION 


L “Support  funding  for  Technical  Support  Center  and  Regional  Computer  Forensic 
Laboratories” 
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Support  For  Direct  Funding  to  the  FBI  for  tire 
National  Cyber-Crime  Technical  Support  Center 

The  FBI  strongly  supports  without  reservation  the  provisions  of  section  109(a)  of  S.2448 
as  a necessary  and  critical  element  in  United  States’  strategy  to  combat  cyber-crime  on  a national 
and  international  level.  The  absence  of  adequate  technical  resources  dedicated  to  the  assistance 
of  law  enforcement  in  this  arena  undermines  daily  the  investigative  efforts  of  federal,  state  and 
local  law  enforcement  officers  dedicated  to  addressing  the  most  troubling  aspects  of  computers 
and  the  Internet  such  as  chSd  sexual  exploitation,  the  dissemination  of  child  pornography,  the 
wholesale  theft  of  intellectual  property,  the  theft  and  disclosure  of  valuable  trade  secrets  as  well 
as  countless  more  traditional  crimes  now  being  facilitated  by  the  use  of  computers.  The  FBI’s 
existing  technical  expertise,  established  with  the  FBI  Laboratory  Divisions ’s  Engineering 
Research  Facility,  demonstrates  the  prudence  in  providing  funding  dedicated  for  these  expressed 
purposes  directly  with  the  Director  of  the  FBI  as  the  most  effective  means  of  ensuring  that  such  a 
facility  is  constructed  and  made  operational  with  the  least  delay  possible.  Senate  Bill  244S's 
approach  is  necessary,  prudent  and  expeditious. 


1 
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Support  for  Direct  Fundiag  to  the  FBI  for  the  Creation  of 
Regional  Computer  Forensic  Laboratories 


The  FBI  also  supports  without  reservation  the  provisions  of  section  109(b)  of  S. 2448 
authorizing  direct  funding  to  the  FBI  for  the  express  purpose  of  creating  up  to  ten  (10)  Regional 
Computer  Forensic  Laboratories  (RCFLs). 

The  FBI  notes  that,  by  separating  Binding  for  RCFLs  under  section  1 09(b)  of  S . 2443 
from  State  Binding  for  task  forces  and  other  DOI  controlled  investigative  initiatives  under 
109(c),  the  bid  implicitly  acknowledges  the  difference  between  a true  computer  forensics 
capability  which  is  and  should  be  an  objective,  scientific  function  and  a computer  investigative 
capability1,  and  have  appropriately  chosen  to  lodge  responsibility  for  the  former  with  tbeFBI 
through  its  laboratory  division. 

It  is  well  known  that  the  FBI  Laboratory  Division  was  instrumental  in  the  development 
and  realization  of  a Regional  Computer  Forensic  Laboratory  in  San  Diego,  California  at  which 
federal,  state  and  local  law  enforcement  officers  work  side  by  side  sharing  both  expertise  and 
expensive  equipment  and  software  vital  to  the  forensic  recovery  of  often  critical  criminal 
evidence  from  computers  and  other  digital  media.  The  FBI  Laboratory  utilized  its  own  financial 
resources  to  make  the  San  Diego  RCFL  a reality  and  is  providing  extensive  computer  forensic 
training  to  state  mid  local  officers  of  that  facility  both  at  the  FBI  Academy  and  through  computer 
industry  recognized  training  programs.  The  FBI  Laboratory  Division  now  has  some  twenty  (201 
years  experience  k the  science  of  computer  forensics  through  its  Computer  Analysis  Response  * 
Team  (CART).  With  CART  scheduled  to  expand  from  its  current  forensic  complement  of  over 
120  examiners  to  over  300  by  the  beginning  of 2002  (which  will  continue  to  secure  its  place  as 
the  single  largest  computer  forensic  entity  k the  world),  it  only  makes  good  sense  to  harness  the 
m s expertise  and  knowledge  of  scientific  method  and  forensic  “best  practices”  as  the  means  of 
jump  starting  a legitimate  state  and  local  computer  forensic  capability.  'The  key  to  the  success  of 
the  San  Diego  RCFL  will  be  the  key  to  success  for  future  RCFLs,  namely  the  ability  to  move 
quickly  with  a minimum  of  administrative  expense,  overhead  or  red  tape*  S.2448's  direct 
funding  appropriation  make  this  possibility  a reality. 

_ For  these  and  many  other  reasons,  the  FBI  strongly  supports  the  allocation  of  direct 
funding  for  RCFLs  to  the  FBI. 


A Computer  investigate  capability  typically  requires  specially  trained  officers  who  arc  versed  in  Internet 
culture.  Internet-based  poaa  said  cthe  fraud  schemes  as  well  as  Internet  chat  vernacular  enabling  them  to  go  on-line 
undercover  to  detect  and  investigate  criminal  behavior.  In  comparison,  the  locus  of  a computer  forensics  capability 
is  t he  recovery,  extraction,  interpretation  and  stabili&ukin  of  digits  evidence,  usually  from  digital  stora  ge  media 
such  as  a computer  hard  drive  seized  as  a result  of  a computer  in  vestigation.  Computer  forensic  examiners  tvpicallv 
are  required  to  possess  and  master  a tar  more  detailed  knowledge  of  electronics,  computer  hardware  assembly  and  ’ 
operation  and  software  programing  and  operation  than  would  be  necessary  for  a computer  investigator.  A comouter 
forensic  faerhty  is  more  detached  from  heat  of  the  mvestigatba  and  employs  scfctairically  proven  or  acceowd  * 
methodologies  to  recover  either  inculpatory  or  exculpatory  evidence  from  a digital  medium. 
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MATTER  CONTAINED 


'TweaMng”  of  language  in  the  amending  Pen  Register/Trap  and  Trace  Statute, 
(Kyi/Schumer) 
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Amendments  to  the  Pen  Register  and  Trap  & Trace  Statitte 


It  is  suggested  that  the  last  sentence  of  the  proposed  modification  of  18  U.S.C.  § 
3 122(a)  (and  its  legislative  history)  be  changed  to  make  dear  that  service  of  the  new  single, 
nation-wide  court  order  is  not  required  upon  all  providers  in  the  communication  chain  ifa  single 
provider  has  access  to  ail  transmission  data.  The  suggested  change  is: 


9 

11 


13 

IS 


17 


19 

21 


It  Is  also  suggested  that  the  proposed  revision  to  3 123  subsection  (b)  (1),  new 
subparagraph  (C)  be  changed  for  the  reasons  stated  below  in  the  proposed  legislative  history: 

“(C)  a description  of — 

, the fcg§mc|i nahme  of  tp;Communicafions  to  which  the  order  applies, 

sdpras)yific!uding-the  number  or  other  identifier5* 


23 


25 

27 

29 

31 

33 

35 

37 

39 


41 


Proposed  Legislative  History 

Existing  Subsection  (C)  is  intended  to  require  the  identification  of  the  “facility”  to  which  the  pen 
register  or  trap  and  trace  is  applied.  Historically  this  was  accomplished  by  Identifying  the 
telephone  number  of  the  targeted  telephone,  and  if  known  the  physical  location  of  that  telephone. 
W ith  the  increase  in  electronic  communications  via  e-mail,  chat  sessions,  instant  Messaging,  or 
telenet  sessions,  it  may  not  always  be  possible  to  identity  a static  “facility.”  In  cases  of  dynamic 
addressing  of  Internet  accounts  and  telenet  sessions  for  example,  it  is  difficult  to  describe  the 
facility  through  a static  number.  To  address  this,  the  statute  should  permit  the  applicants  to 
describe  the  technical  nature  of  the  communications  as  a means  of  further  identifying  the  facility 
to  which  the  order  applies.  Examples  might  include  the  computer  protocol  or  computer  language 
utilized,  or  any  dynamically  assigned  message  identification  number  or  code  or  part  thereof" 

The  bill  also  inserts  “routing,  addressing”  into  the  phrase  “dialing  and  signaling  information”  in 
section  3 121(c)  and  other  provisions  of  the  statute.  The  term  “signaling”  has  historically  been 
given  an  expansive  reading  to  include,  in  the  electronic  communications  world  (e.a.,  e-mail) 
much  of  what  would  be  “routing  and  addressing”  and  then  some.  It  is  stressed  that  the  insertion 
and  existence  of  “routing,  addressing”  into  the  statute  is  not  intended  to  limit  the  interpretation 
of  t he  term  "signalirig/’ 


Pen  ResisicrlVap  Trarc  Amendments 
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Counting  Prior  State  Computer  Crime  Offenses: 


A new  § I030(e)(3  0)  would  define  conviction  to  include  prior  Federal  juvenile 
adjudications  for  violations  of  § 1030.  Given  that  the  majority  of  States  now  have  unauthorized 
computer  access  or  similar  computer  crime  statutes2,  it  is  suggested  that  the  proposed  new 
definition  of  conviction  be  further  expanded  to  include  prior  State  computer  convictions.  The 


' 2 Some  45'States  have  enacted  statutes  prohibiting,  to  varying  degree,  computer  crime: 
AL  Computer  Crime  Act,  Code  of  Alabama,  Sections  13A-8-lG0to  13A-8~103-  AK  Statutes 
Sections  11.46.200(a)(3),  11. 46.484(a)(5),  11.46.740, 11.46.985, 11.46.990;  AZ  Revised  ' 
Statues  Annotated,  Sections  13-2301(E),  13-2316;  CA  Penal  Code,  Section  502;  CO  Revised 
Statutes,  Sections  18-5.5-10.1, 18-5.5-102;  CT  General  Statutes,  Sections  53a-25G  to  53a*261 
52-570b;  DH  Code  Annotated,  Title  1 1,  Sections  931-938;  FI  Computer  Crimes  Act,  Florida 
Statutes  Annotated,  Sections  815.01  to  815.07;  GA  Computer  Svstems  Protection  Act  Georgia 
Codes  Annotated,  Sections  16-9-90  to  16-9-95;  HI  Revised  Statutes,  Sections  708-890  to  780- 
896;  ID  Code,  Title  18,  Chapter  22,  Sections  18-2201,  18-2202;  H Annotated  Statutes 
(Criminal  Code),  Sections  15-1,  16-9;  IN  Code,  Sections  35-43-1-4, 35-43-2*3;  IO  Statutes, 
Sections  716A.  1 to  716A.16;  KS  Statutes  Annotated,  Section  21-3755;  KY  Revised  Statutes 
Sections  434.840  to  434.860;  LA  Revised  Statutes,  Title  14,  Subpart  D.  Computer  Related 
Crimes,  Sections  73. 1 to  73.5;  ME  Revised  Statutes  Annotated,  Chapter  15,  Title  17-A,  Section 
357;  MD  Annotated  Code,  Article  27,  Sections  45A  and  146;  MA  General  Laws,  Chapter  266 
Section  30;  MI  Statutes  Annotated,  Section  28.529(])-{7);  MN  Statutes  (Cranbal  Code), 
Sections  609.87  to  609,89;  Ml  Code  Annotated,  Sections  97-45-1  to  97-45-13;  MS  Revised 
Statutes,  Sections  569.093  to  569.099;  MT  Code  Annotated,  Sections  45-2-101,  45-6-310  45- 
6r  J 1 1 , NE  Revised  Statutes,  Article  13{p)  Computers,  Sections  28-1343  to  28-1348'  NV 
Revised  Statutes,  Sections  205.473  to  205.477;  NH  Revised  Statutes  .Annotated,  Sections 
638. 16  to  638:19;  NI  Statutes,  Title  2C,  Chapter  20,  Sections  2C.20-1, 2C;20-23  to  2C:2G-34 
and  Title  2A,  Sections  2A.38A-1  to  2A:3SA-3;  NM  Statutes  Annotated,  Criminal  Offenses 
Computer  Crimes  Act,  Sections  30-16A-1  to  30-16A-4;  NY  Penal  Law,'  Sections  1 55  00  ’ 
156.00  to  156.50, 165.35  subdiv.  10, 170.00, 175.00  NC  General  Statutes,  Sections  14-453  to 
14-457;  ND  Century  Code,  Sections  12.1-06.1-01  subsection  3, 12.1-06. 1-08-  OH  Revised 
Code  Annotated,  Sections  2901.01,  2913.01,  2913.04,  2913.81;  OK  Computer  Crimes  Act 
Oklahoma  Session  Laws,  Title  21,  Sections  1951-1956;  OR  Revised  Statutes,  Sections  164325 
! 64,377;  PA  Consolidated  Statutes  Annotated,  Section  3933;  Ri  General  Laws  (Criminal 
Offenses),  Sections  11-52-1  to  11-52-5  SC  CodeofLaws,  Sections  16-16-10  to  16-16^0  SD 
Codified  Laws,  Sections  43-43B-1  to  43-43B-8;  IN  Code  Annotated,  Computer  Crimes  Act 
Sections  39-3-1401  to  39-3-1406;  TX  Codes  .Annotated,  Title 7,  Chapter  33,  Sections  33'oi’to 
33.05;  UT  Computer  Fraud  Act,  Utah  Code  Annotated,  Sections  76-6-701  to  76-6-704:  VA 
Computer  Crime  Act,  Code  of  Virginia,  Sections  18.2-152.1  to  38  2-152  14-  WA  Revised  Code 
-Annotated,  Sections  9A.4S.  100,  9A.52.010, 9A.52. 1 10  to  9A.52, 130  W1  Statutes  Annotated 
Section  943.70;  WY  Statutes,  Sections  6-3-501  to  6-3-505, 
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suggested  additional  language  to  the  proposed  bills’  § 1 03O(e)(lO)  version  would  be: 


3 

5 

7 


and 

(B)  a conviction  under  the  law  of  anv  State  for  a crime  punishable  hv 
imprisonment  for  more  than  1 year,  an  element  of  which  is  unauthorized 
access,  or  exceeding  authorized  access,  to  a computer.” 


Given  the  fact  that  most  section  1030  offenders  are  juveniles  and  statistically 
more  likely  to  first  receive  State  juvenile  abdications,  it  is  further  recommended  that  the 
provision  go  even  gather  than  that  outline  above  by  including  prior  State  juvenile  adjudications. 


13 

15 

17 


19 


21 

23 

25 

27 


Expanding  the  Definition  of ‘loss”  to  Include  Preventative  Reconfiguration: 

Another  recommendation  for  the  Hatch  BilHs  that  the  proposed  definition  of 

"loss"  in  Section  1030(e)(l  1)  be  made  clearer  to  include  the  cost  of  plugging  holes  in  computer 
defenses  as  a means  of  preventing  future  attacks--so  called  "preventative  re-  ; 

conjiguration'reprogranimirig."  The  new  language  could  read: 

“(]  0 the  term  “loss”  means  any  reasonable  cost  to  any  victim,  including  the  cost 
of  responding  to  an  offense,  conducting  a damage  assessment,  implementation  of 
responsive  security  measures  or  r^Qnfisiir<ittDn  resson&blyrcsiculflted  to  prevent 
&ture .damage,  and  restoring  the  data,  program,  system,  or  Information  to  Sis 
condition  prior  to  the  offense,  and  any  revenue  lost,  cost  incurred,  or  other 
consequential  damages  incurred  because  of  mtemiptlon'of  service;"' 


29 
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MATTER  CONTAINED 

IN  BILLS  CURRENTLY  UNDER  CONSIDERATION 


Oppose  Expansion  of  Secret  Service  18  U.S.C.  §1030  jurisdiction. 


X 
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Executive  Summary 


Basis  of  Opposition  to  Amendment  to  Grant  Concurrent  Jurisdiction  to  the  United  States 

Secret  Service  in  Section  1030  Offenses. 

The  proposed  amendment  to  section  1030(d)  of  Tide  18  would  grant  concurrent 
jurisdiction  to  the  United  States  Secret  Service  (USSS)  to  investigate  all  crimes  found  in  Section 
1030. 


In  1996,  Congress  specifically  iimitpd  the  Secret  Service’s  authority  to  investigate  crimes 
under  IS  U.S.C.  § 1030  to  only  those  offenses  under  subsections  (a)(2)(A)  and  (B),  (a)(3),  (a)(4), 
(a)(5)  and  (a)(6).  The  Senate  Report  accompanying  the  1996  amendment  explained  that: 

ftjhe  new  crimes  proposed  in  the  bill,  however,  do  not  fail  under  the  Secret 
Service’s  traditional  jurisdiction.  Specifically,  proposed  subsection  1030(a)(2)(C) 
addresses  gaps  in  18  U.S.C,  23 14  (interstate  transportation  of  stolen  property), 
and  proposed  section  1030(a)(7)  addresses  gaps  in  18  U.S.C.  1951  (the  Hobbs 
Act)  and  S75  (interstate  threats).  These  statutes  are  within  the  jurisdiction  of  the 
Federal  Bureau  of  Investigation,  which  should  retain  exclusive  jurisdiction  over 
these  types  of  offenses,  even  when  they  are  committed  by  computer. 

S,  Rep.  No.  357, 104th  Cong.,  2d  Sess.  13  (1996). 

Inherent  in  the  1996  changes  was  the  recognition  that  the  statute  was  being  amended  to 
reflect  the  respective  investigati  ve  jurisdictional  limits  existing  at  that  time.  It  was  dear  at  that 
time,  that  the  jurisdiction  of  the  Secret  Service,  found  at  18  U.S.C.  § 3056,  did  not  encompass 
the  types  of  offenses  described  in  Section  1030  (aXi),  (a)(2)(C),  or  (a)(7).3  Given  that  there 
have  been  no  additional  grants  of  investigative  jurisdiction  to  the  USSS  since  that  amendment, 
the  current  proposal  to  grant  jurisdiction  to  the  USSS  is  at  best  questionable.  The  theft  of 
National  Security'  information  which  is  the  type  of  information  Section  1030(a)(1)  was  intended 
to  address  has  never  been  the  subject  of  USSS  jurisdiction,  nor  should  it  be.  In  addition,  the 
U'pes  of  crimes  contemplated  by  1030(a)(2)(C)  and  (a)(7),  as  recognized  by  the  legislative 


3 *Un<fef  the  direction  of  the  Secretly  of  the  Treasury,  the  Secret  Service  is  authorized  to  detect  and  arrest  any 
person  who  violates  - 

O ) section  50$,  509 1 5 10,  S7 1 , or  $79  of  this  title  or,  with  respect  to  the  Federal  Deposit  Insurance  Corporation, 
Federal  land  banks,  and  Federal  land  bank  associations,  section  213. 216,433, 493, 657>  709, 1006  1007  $01 1 101 3 $014 
1907,  or  1909  of  this  tide; 

(2)  any  of  the  laws  of  the  United  States  relating  to  coins,  obligations,  and  securities  of  the  United  States  and  of  Iordan 
governments:  or 

(3  ) any  of  the  laws  of  the  United  Sta  tes  relating  to  electronic  fond  trans  fer  frauds,  credit  and  debit  cord  frauds,  an  d 
false  identification  documents  or  de  vices;  except  that  the  authority  conferred  by  this  parag  raph  s hall  be  exerc  i sed  subject  tot  he 
agreement  of  the  Attorney  General  and  the  Secretary  of  the  Treasury  and  shall  not  affect  the  authority  of  any  other  Federal  law 
enforcement  agency  with  respect  to  those  law  s. 
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history,  have  traditionally  been  investigations  solely  k the  province  of  the  FBI. 


The  1996  provision  is  an  explicit  effort  by  Congress  to  address  the  criminal  offenses  at 
i ssue  through  a di  vision  of  labor  primarily  determined  by  investigative  responsibility  and 
expertise.  Any  reversion  to  the  pre- 1996  jurisdictional  provisions  raises  serious  issues  and 
concerns  about  the  utilization  of  resources.  Concurrent  jurisdiction  will  result  in  a duplication  of 
efforts  that  will  waste  resources  and  will  encourage  independent  investigations  by  separate 
agencies  at  the  expense  of  coordinated  joint  efforts.  " r 


Basis  ot  Opposition  to  Expanded  Secret  Service  Jurisdiction  under  18  U.S.C.  §1030 
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MATTER  NOT  CONTAINED 
IN  BILLS  CURRENTLY  UNDER  CONSIDERATION. 

Cable  Communications  Act  amendment. 
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Executive  Summary 

Cable  Communications  Policy  Act  Amendment 


The  Cable  Communications  Policy  Act,  passed  in  1984  to  regulate  various  aspects  of  the 
cable  television  industry,  did  not  take  into  account  the  changes  in  technology  that  have  occurred 
over  the  last  fifteen  years.  Cable  television  companies  now  often  provide  Internet  access  and 
telephone  service  in  addition  to  television  programming.  This  amendment  clarifies  that  when  a 
cable  company  acts  as  a telephone  company  or  an  Internet  service  provider,  it  must  comply  with 
the  laws  governing  the  interception  and  disclosure  of  wire  and  electronic  communications  just 
like  any  other  telephone  company  or  Internet  sendee  provider. 


Cable  Communications  Policy  Act  Amendment 
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UNITED  STATES  CODE  ANNOTATED 
TITLE  47.  TELEGRAPHS,  TELEPHONES,  AND  RADIOTELEGRAPHS 
CHAPTER  5-WIRE  OR  RADIO  COMMUNICATION 
SUBCHAPTER  VAC-CABLE  COMMUNICATIONS 
PART  ^-MISCELLANEOUS  PROVISIONS 


Section  551.  Protection  of  subscriber  privacy 

(a)  Notice  to  subscriber  regarding  personally  identifiable  information;  definitions 

(1)  At  the  time  of  entering  into  an  agreement  to  provide  any  cable  service  or  other  service 
to  a subscriber  and  at  least  once  a year  thereafter,  a cable  operator  shall  provide  notice  in 
the  fontt  of  a separate,  written  statement  to  such  subscriber  which  clearly  and 
conspicuously  informs  the  subscriber  of— 

(A)  the  nature  of  personally  identifiable  information  collected  or  to  be  collected 
with  respect  to  the  subscriber  and  the  nature  of  the  use  of  such  information; 

(B)  die  nature,  frequency,  and  purpose  of  any  disclosure  which  may  be  made  of 
such  informatio  n,  including  an  identification  of  the  types  of  persons  t o whom  the 
disclosure  may  be  made; 

(€)  the  period  during  which  such  information  will  be  maintained  bv  the  cable 
operator, 

OD)  the  times  and  place  at  which  the  subscriber  may  have  access  to  such 
information  in  accordance  with  subsection  (d)  of  this  section;  and 
(E)  the  limitations  provided  by  this  section  with  respect  to  the  collection  and 
disclosure  of  information  by  a cable  operator  and  the  right  of  the  subscriber  under 
subsections  (I)  and  (h)  of  tnis  section  to  enforce  such  limitations. 

In  the  case  of  subscribers  who  have  entered  into  such  an  agreement  before  the  effective 
date  of  this  section,  such  notice  shall  be  provided  within  1 SO  days  of  such  date  and  at 
least  once  a year  thereafter. 

(2)  For  purposes  of  this  section,  mher  than  subsection  (h)  of  this  section- 

(A)  the  term  "personally  identifiable  information"  does  not  include  any  record  of 
aggregate  data  which  does  not  identify  particular  persons; 

(B)  the  term  "other  service"  includes  any  wire  or  radio  communications  service 
provided  using  any  of  the  tacilities  of  a cable  operator  that  are  used  in  the 
provision  of  cable  service;  and 

(C)  the  term  "cable  operator"  includes,  in  addition  to  persons  within  the  definition 
of  cable  operator  in  sect  ion  522  of  this  title,  any  person  who  (I)  is  owned  or 
controlled  by,  or  under  common  ownership  or  control  with,  a cable  operator,  and 
(ii)  provides  any  wire  or  radio  communications  service. 
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(b)  Collection  of  personally  identifiable  information  using  cable  system 

(I)  Except  as  provided  in  paragraph  (2),  a cable  operator  shall  not  use  the  cable  system  to 
collect  personally  identifiable  information  concerning  any  subscriber  without  the  prior 
written  or  electronic  consent  of  the  subscriber  concerned. 


(2)  A cable  operator  may  use  the  cable  system  to  collect  such  information  in  order  to- 

(A)  obtain  information  necessary  to  render  a cable  service  or  other  sendee 
provided  by  the  cable  operator  to  the  subscriber,  or 

(B)  detect  unautho  rized  reception  of  cable  communications. 


(c)  Disclosure  of  personally  identifiable  information 

(!)  Except  as  provided  in  paragraph  (2)s  a cable  operator  shall  not  disclose  personally 
identifiable  information  concerning  any  subscriber  without  the  prior  written  or  electronic 
consent  of  the  subscriber  concerned  and  shah  take  such  actions  as  are  necessary  to 
prevent  unauthorized  access  to  such  information  by  a person  other  than  the  subscriber  or 
cable  operator. 


(2)  A cable  operator  may  disclose  such  information  if  the  disclosure  is- 

(A)  necessary  to  render,  or  conduct  a legitimate  business  activity  related  to,  a 
cable  service  or  other  service  provided  by  the  cable  operator  to  the  subscriber; 

(B)  subject  to  subsection  (h)  of  this  section,  made  pursuant  to  a court  order 
authorizing  such  disclosure,  if  the  subscriber  is  notified  of  such  order  by  the 
person  to  whom  the  order  is  directed;  or 


(C)  a disclosure  of  the  names  and  addresses  of  subscribers  to  any  cable  service  or 
other  service,  if-- 

(i)  the  cable  operator  has  provided  the  subscriber  the  opportunity  to 
prohibit  or  limit  such  disclosure,  and 

(ii)  the  disclosure  does  not  reveal,  directly  or  indirectly,  the- 

(I)  extent  of  any  viewing  or  other  use  by  the  subscriber  of  a cable 
service  or  other  service  provided  by  the  cable  operator,  or 

(II)  the  nature  of  any  transaction  made  by  the  subscriber  over  the 
cable  system  of  the  cable  operator?!  H 


Such  disclosure:  shall  not  include  records  revealing  customer  cable  television 
viewutg  activity.  For  purposes  of  this  section,  “customer  cable  television  viewing 
activity"  shall  mean  the  cable  customer  viewing  habits  of  operator-selected,  pre-' 
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3 

(d)  Subscriber  access  to  information 
5 

A cable  subscriber  shall  be  pro  vided  access  to  all  personally  identifiable  information  regarding 
7 that  subscriber  which  is  collected  and  maintained  by  a cable  operator.  Such  information  shall  be 
made  available  to  the  subscriber  at  reasonable  times  and  at  a convenient  place  designated  by 
S such  cable  operator.  A cable  subscriber  shall  be  provided  reasonable  opportunity  to  correct  any 
error  in  such  information.  . 

11  ' ' 


1 3 (e)  Destruction  of  information 

15  A cable  operator  shall  destroy  personally  identifiable  information  if  the  information  is  no  longer 
necessary'  for  the  purpose  for  which  it  was  collected  and  there  are  no  pending  requests  or  orders 
1 7 for  access  to  such  information  under  subsection  (d)  of  this  section  or  pursuant  to  a court  order. 

19  v 

(f)  Civil  action  in  United  States  district  court;  damages;  attorney's  fees  and  costs;  nonexclusive 
21  nature  of  remedy 


23 

25 

27 

29 

31 

33 


(1)  Any  person  aggrie  ved  by  any  act  of  a cable  operator  in  violation  of  this  section  may 
bring  a civil  action  in  a United  States  district  court. 

(2)  The  court  may  award—  * 

(A)  actual  damages  but  not  less  than  liquidated  damages  computed  at  the  rate  of 
$100  a day  for  each  day  of  violation  or  $1,000,  whichever  is  higher; 

(B)  punitive  damages;  and 

(C)  reasonable  attorneys’  fees  and  other  litigation  costs  reasonably  incurred. 

( ” } The  remedy  provided  by  this  section  shall  be  in  addition  to  any  other  lawful  remedy 
available  to  a cable  subscriber. 


3 5 (g)  Regulation  by  States  or  franchising  authorities 

3 7 Nothing  in  this  subchapter  shall  be  construed  to  prohibit  any  State  or  any  franchising  authority' 

from  enacting  or  enforcing  laws  consistent  with  this  section  for  the  protection  of  subscriber 
39  privacy. 


41 

(h)  Disclosure  of  information  to  go  vernmental  entity  pursuant  to  court  order 
43 
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Except'  $s  A governmental  entity  may  obtain  personally 

identifiable  information  concerning  a cable  subscriber  pursuant  to  a court  order  only  i£  in  the 
court  proceeding  relevant  to  such  court  order— 

(1)  such  entity  offers  dear  and  convincing  evidence  that  the  subject  of  the  information  is 
reasonably  suspected  of  engaging  in  criminal  activity  and  that  the  information  sought 
would  be  material  evidence  in  the  case;  and 

(2)  the  subject  of  the  information  is  afforded  the  opportunity  to  appear  and  contest  such 
entity's  claim. 


PROPOSED  LEGISLATIVE  HISTORY  FOR 
AMENDMENTS  TO  THE  CABLE  COMMUNICATIONS  POLICY  ACT 


The  Cable  Communications  Policy  Act  currently  establishes  two  different  sets  of  rules 
regarding  privacy  protection  and  disclosure  to  law  enforcement:  one  governing  cable  service 
(“Cable  Act”)  (47  U.S.C.  §551),  and  the  other  applying  to  the  use  of  telephone  service  and 
Internet  access,  (the  wiretap  statute  (IS  U.S.C  §2510  the  Electronic  Communications 

Policy  Act  f £CP A”)  (IS  U.S.C.  §2701  et.seg.),  and  the  pen  register  and  trap  and  trace  statute 
(1 8 U.S.C,  §3121  gt  sgff  ).  Yet  today,  unlike  in  1984  when  Congress  passed  the  Cable 
Communications  Policy  Act,  many  cable  companies  offer  not  only  traditional  cable 
programming  services  but  also  Internet  access  and  telephone  service.  The  rules  governing  law 
enforcement  access  to  the  records  of  communication  service  providers’  customers,  however, 
should  not  depend  on  whether  the  customer  has  chosen  to  use  a cable  company  or  a more 
traditional  type  of  provider  for  Ids  telephone  or  Internet  service.  Congress  believes  that  cable 
companies  offering  such  services  should  comply  with  court  orders  and  other  legal  process 
permitted  under  the  wiretap  statute,  ECPA,  and  the  pen  register  and  trap  and  trace  statute  with 
respect  to  their  telephone  and  Internet  customers. 

In  recent  years,  however,  cable  companies  have  increasingly  balked  at  complying  with 
such  process,  noting  the  seeming  inconsistency  of  these  statutes  with  their  duty  of  nondisclosure 
(except  under  stringent  limits)  under  the  Cable  Communications  Policv  Act  Seg  in  re 
Application  of  United  States,  36  F.  Sup  p.  2d  __  (D.  Mass.  Feb.  9, 1999)  (noting  apparent 
statutory  conflict  and  ultimately  granting  application  for  order  under  IS  U.S.C.  2703(d)  against 
cable  company  providing  Internet  service).  These  complications  have  at  times  delayed  or” 
frustrated  investigations. 

In  addition,  section  551  flawed  because  it  permits  law  enforcement  to  obtain 
information  only  when  that  information  constitutes  evidence  of  an  offense.  In  some  cases 
however,  the  information  sought  from  a service  provider  5s  not  evidence  of  a crime,  even  thotmh 
11  he!Ps  t0  solve  one.  For  example,  law  enforcement  officials  may  try  to  arrest  a fugitive  who  is 
accessing  his  e-mail  account  from  a remote  location,  and  they  need  to  obtain  information  from 
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the  cable  company  that  shows  from  what  location  he  is  accessing  that  account.  Moreover, 
whether  law  enforcement  can  obtain  a court  order  to  obtain  such  information  should  not  depend 
on  whether  the  fugitive  has  chosen  to  connect  to  the  Internet  using  a cable  company  instead  of  a 
traditional  Internet  service  provider. 


Accordingly,  the  amendment  inserts  a new  subsection  55 1(c)(2)(D)  to  confirm  that  cable 
companies,  like  other  providers,  remain  subject  to  ECPA,  the  wiretap  statute,  and  the  trap  and 
trace  statute  with  respect  to  the  provision  of  telephone  and  Internet  services,  notwithstanding 
section  551.  The  definition  ofBcustomer  cable  television  viewing  activity”  is  intended  to 
exclude  from  disclosure  under  chapters  1 \%  121,  or  206  of  title  18  of  the  United  States  Code 
traditional  cable  and  broadcast  television  video/audio  presentations  Unlike  Internet  video 
presentations,  the  subject  content  and  timing  of  which  are  selected  by  the  cable  customer,  the 
selection  and  timing  of  television  presentations  are  controlled  by  the  operator.  The  disclosure 
exclusion  is  not  intended  to  encompass  or  prohibit  the  disclosure  by  an  operator  of  records  or 
formation  relating  to  television  presentations  which  are  re-transmitted  through  the  Internet. 
Records  relating  to  such  re-transmissions  would  be  treated  like  all  other  Internet-related  records 

Tr  Saifrf  ii9,  !21,  or  206  oftit3e  3S-  The  amendment,  however,  is  intended  to  preserve 
me  Cable  Act’s  primacy  with  respect  to  records  revealing  what  ordinary  cable  television 
programing  a customer  chooses  to  purchase,  such  as  particular  premium  channels  or  “pay  per. 
view  shows.  Thus,  in  a case  where  a customer  receives  both  Internet  access  and  conventional 
cable  television  service  from  a angle  cable  provider,  a government  entity  can  compel  disclosure 
under  ECPA  only  those  customer  records  relating  to  Internet  service. 
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Executive  Summary 

Necessary  Amendments  to  the  Privacy  Protection  Act  - 42  U.S.C.  § 2060aa,  el  seq. 

. . The  pnvaey  Protection  Act  (PPA)  prohibits  law  enforcement  from  searching  for  or 

seiang  work  product  materials  or  documentary  materials  possessed  by  a person  in  connection 

wt  3 PurPose  to  disseminate  them  to  the  public  in  a newspaper,  book,  broadcast,  or  other 

srnii  ar  form  of  public  communication.  Originally  adopted  to  prevent  the  search  of  third  party 

news-gathers  m traditional  media  (e.g.,  newspaper  press  rooms,  tv  editor  offices),  the  PPA  has 

generated  unforseen  obstacles  for  law  enforcement  when  applied  to  the  search  of  a criminal’s 

personal  computers  tf  the  computers  coincidentally  are  being  used  for  web  site  publishing  A 

scenario  frequently  encountered  by  law  enforcement  involves  the  seizure  of  a computer  used  to 

disseminate  child  pornography  which  may  coincidentally  also  control  the  e-mail  and/or  websites 

ot  the  suspect  and  third  parties.  Because  of  the  size  of  modem  personal  computer  hard  dri  ves 

cjday  most  computers  cannot  effectively  be  searched  on  scene,  but  are  usually  seized  &$t  then 

searched  later  m a computer  forensic  environment  as  expressly  provided  for  by  a magistrate 

Unfortunately,  such  a practice  creates  a dilemma  for  investigators  who  may 

plater  diirntg  tHe  exammatIon  Process  Potential  third  party  news  gatherer  material  may' 

„ he  C?mpT 6r  SySief'  The  reaHz2t!0n  TOa>' be  t0° 1ate  as  the  PPA  prohibits  both  search 

and  seizure  of  such  material. 

_ , Amendments  detailed  herein  would  carve  out  a reasonable  exception  to  the  Act  when  the 

search  or  seizure  of  work  product  materials  or  documentary  materials  is  incident  al  to”  the 

dnwrf  S6Tc  050thtreyidefiC€  rdevant  t0  3 erime-  ^us,  the  seizure  of  a computer  hard 
m^t,  thfd  part>' for  eV5dsnce  of  child  pornography  would  not  be  prohibited 

S4edTSth^PpTe  hard  drfVe  COnt;Uaed  W°rk  Pr°duct  °r  0ther  d0CU!^e"^y  material 
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X [redime  strikeou  t version  of  amendments  to  the  Privacy  Protection  Act] 

3 UNITED  STATES  CODE  ANNOTATED 

TITLE  42.  THE  PUBLIC  HEALTH  AND  WELFARE 
5 CHAPTER  21A~PRIV'ACY  PROTECTION 

SUBCHAPTER  I-FIRST  AMENDMENT  PRIVACY  PROTECTION 
7 - ,,  PART  A-JUNLAWFUL  ACTS 

9 Section  2000aa.  Searches  and  seizures  by  government  officers  and  employees  in  connection  with 

investigation  or  prosecution  of  criminal  offenses 

11 


13 


(a)  Work  product  materials 
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i notwithstanding  any  other  law,  it  shall  be  unlawful  for  a government  officer  or  employee  in 
connection  with  the  investigation  or  prosecution  of  a criminal  offense,  to  search  for  or  seize  any 
work  product  materials  possessed  by  a person  reasonably  believed  to  have  a purpose  to 
disseminate  to  the  public  a newspaper,  book,  broadcast,  or  other  similar  form  of  public 
communication,  in  or  affecting  interstate  or  foreign  commerce;  but  this  provision  shall  not 
impair  or  affect  the  ability  of  any  government  officer  or  employee,  pursuant  to  otherwise 
applicable  law,  to  search  for  or  seize  such  materials,  if- 

(!)  there  is  probable  cause  to  believe  that  the  person  possessing  such  materials  has 
committed  or  is  committing  the  criminal  offense  to  which  the  materials  relate:  Provided 
however.  That  a government  officer  or  employee  may  not  search  for  or  seize  such 
materials  under  the  provisions  of  this  paragraph  if  the  offense  to  which  the  materials 
relate  consists  of  the  receipt,  possession,  communication,  or  withholding  of  such 
materials  or  the  information  contained  therein  (but  such  a search  or  seizure  may  be 
conducted  under  the  provisions  of  this  paragraph  if  the  offense  consists  of  the  receipt 
possession,  or  communication  of  infoimation  relating  to  the  national  defense,  classified 
information,  or  restricted  data  under  the  pro  visions  of  section  793,  794,  797  or  79$  0f 
Title  38,  or  section  2274, 2275  or  2277  of  this  title,  or  section  783  of  Title  50  or  "if  the 
offense  involves  the  production,  possession,  receipt,  mailing,  sale,  distribution,’  shipment 
or  transportation  of  child  pornography,  the  sexual  exploitation  of  children,  or  the  sale  or’ 
purchase  of  children  under  section  2251, 2251 A,  2252,  or  2252A  of  Title  18);  m 

(2)  there  is  reason  to  believe  that  the  immediate  seizure  of  such  materials  is  necessary'  to 
prevent  the  death  of  or  serious  bodily  injury  to,  a human  being-fgr 

^execution  of 
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(b)  Other  documents 

Notwithstanding  any  other  law,  it  shall  be  unlawful  for  a government  officer  or  employee,  in 
connection  with  the  investigation  or  prosecution  of  a criminal  offense,  to  search  for  or  seize 
documentary  materials,  other  than  work  product  materials,  possessed  by  a person  in  connection 
with  a purpose  to  disseminate  to  the  public  a newspaper,  book,  broadcast,  or  other  similar  form 
of  public  communication,  in  or  affecting  interstate  or  foreign  commerce;  but  this  provision  shall 
not  impair  or  affect  the  ability  of  any  government  officer  or  employee,  pursuant  to  otherwise 
applicable  law,  to  search  for  or  seize  such  materials.  If— 


(1)  there  is  probable  cause  to  believe  that  the  person  possessing  such  materials  has 
committed  or  is  committing  the  criminal  offense  to  which  the  materials  relate;  Provided, 
however,  That  a government  officer  or  employee  may  not  search  for  or  seize  such 
materials  under  the  pro  visions  of  this  paragraph  if  t he  offense  to  which  the  materials 
relate  consists  of  the  receipt,  possession,  communication,  or  withholding  of  such 
materials  or  the  information  contained  therein  (but  sucb  a search  or  seizure  may  be 
conducted  under  the  provisions  of  this  paragraph  if  the  offense  consists  of  the  receipt, 
possession,  or  communication  of  information  relating  to  the  national  defense,  classified 
information,  or  restricted  data  under  the  provisions  of  section  793, 794,  797,  or  798  of 
Title  18,  or  section  2274, 2275,  or  2277  of  this  title,  or  section  783  of  Title  50,  or  if  the 
offense  involves  the  production,  possession,  receipt,  mailing,  sale,  distribution,  shipment, 
or  transportation  of  child  pornography,  the  sexual  exploitation  of  children,  or  the  sale  or 
purchase  of  children  under  section  2251, 2251  A,  2252,  or  2252.4.  of  Title  18); 

(2)  there  is  reason  to  believe  that  the  immediate  seizure  of  such  materials  is  necessary  to 
prevent  the  death  of,  or  serious  bodily  injury  to,  a human  being; 

(3)  there  is  reason  to  believe  that  the  giving  of  notice  pursuant  to  a subpoena  duces  tecum 
would  result  in  the  destruction,  alteration,  or  concealment  of  such  materials;  of 

(4)  such  materials  have  not  been  produced  in  response  to  a court  order  directing 
compliance  with  a subpoena  duces  tecum,  and** 

(A)  all  appellate  remedies  have  been  exhausted;  or 

(B)  there  is  reason  to  believe  that  the  delay  in  an  investigation  or  trial  occasioned 
by  further  proceedings  relating  to  the  subpoena  would  threaten  the  interests  of 
justicerv:§| 


<5)  illiMrif:  pr  examination  of  documentary  materials  is  incidental  to  the.execation  of 


(c)  Objections  to  court  ordered  subpoenas;  affidavits 
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In  the  event  a search  warrant  is  sought  pursuant  to  paragraph  (4)(B)  of  subsection  ( b)  of  this 
section,  the  person  possessing  the  materials  shall  be  afforded  adequate  opportunity  to  submit  an 
affidavit  setting  forth  the  basis  for  any  contention  that  the  materials  sought  are  not  subject  to 
seizure. 
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PROPOSED  LEGISLATIVE  HISTORY  FOR 
AMENDMENTS  TO  THE  PRIVACY  PROTECTION  ACT 

^ The  Privacy  Protection  Act  of  1980  ("PPA"),  42  U.S.C.  § 20OOaa,  et  scq..  makes  it 
unlawful  for  local,  state,  or  federal  law  enforcement  authorities  to  "search  tor  or  seize  any  work 
product  material d'  or  any  “documentary  materials ...  possessed  by  a person  in  connection  with  a 
purpose  to  disseminate  to  the  public  a newspaper,  book,  broadcast,  or  other  similar  form  of 
public  communication.’*  42  U.S.C.  § 2000aa(a),  .(b),  Use  statute  defines  "work  product 
materials"  as  materials  prepared  or  possessed  in  anticipation  of  communicating  such  materials  to 
the  public,  except  .if  the  materials  constitute  contraband  or  the  Suits  or  instrument  alities  of  crime. 
M.  § 2OQ0aa~7(b),  "Documentary  materials,"  on  the  other  hand,  consist  of  materials  upon  which 
information  is  recorded,  once  again  with  the  exception  of  contraband  and  the  fruits  or 
instrumentalities  of  crime.  Id.  § 200Oaa-7(a).  Thus,  other  than  for  the  exceptions,  the  PPA 
effectively  imposes  a "no-search"  rule  on  work  product  materials  and  a "subpoena-first"  rule  on 
documentary  materials  held  by  third  parries  who  plan  to  use  them  to  communicate  to  the  public. 
Although  the  statute  appears  reasonable  on  its  face,  its  application  in  the  current  electronic 
environment  has  inadvertently  shielded  criminal  activities  from  legitimate  law  enforcement 
investigations,  such  efforts  to  arrest  and  prosecute  those  who  distribute  child  pornography  over 
the  Internet. 


(a)  Intent  of  the  PPA 

Congress  passed  the  PPA  in  response  to  the  Supreme  Court’s  decision  in  Zurcher  v. 
Stanford,  Pally,  436  US.  537  (1978).  In  Zurcher,  the  Supreme  Court  upheld  a police  search, 
pursuant  to  a valid  search  warrant,  of  the  offices  of  The  Stanford  D aily  newspaper  for 
photographs  taken  at  the  scene  of  a crime.  The  Court  rejected  the  newspaper's  claim  that  search 
warrants  eoujdnot  be  used  to  recover  evidence  from  those  engaging  in  Tint  Amendment- 
protected  activities.  Id  at  565-567.  The  Court  also  held  that  law  enforcement  officers  could  use 
search  warrants  m recover  evidence  from  innocent  third  parties.  Id.  at  555  ("state's  interest  in 
enforcing  the  criminal  law  and  recovering  evidence  is  the  same  whether  the  third  party  is 
culpable  or  not").  The  Court  concluded,  therefore,  that  “the  critical  element  in  a reasonable 
search  is  not  that  the  owner  of  the  property  is  suspected  of  a crime  but  that  there  is  reasonable 
cause  to  believe  that  the  specific  'things'  to  be  searched  for  and  seized  are  located  on  the  property 
to  which  entry  is  sought”  Id.  at  556. 

In  response  to  the  Court's  ruling.  Congress  passed  the  PPA.  Congress  intended  to  restrict 
searches  for  mere  evidence  of  crime  held  by  innocent  third  parties  who  were  engaged  in  First 
Amendment-protected  activities  — evidence  that  law  enforcement  officials  might  otherwise 
obtain  through  less  intrusive  means,  such  as  by  issuing  a subpoena.  The  purpose  of  restricting 
law  enforcement  in  this  fashion,  of  course,  was  to  protect  the  confident  iality  of  non-evidentiary 
files  also  held  by  this  special  group  of  innocent  third  parries  — both  the  drafts  of  art  icles  not  yet 
published  and  the  research  and  other  supporting  information  (e.g.,  notes  and  interviews)  which 
they  never  intended  to  publish.  Thus,  the  PPA  protects  an  author  or  publisher  (like  The  Stanford 
Daily)  — who  is  not  a suspect  in  the  investigation  — from  law  enforcement  attempts  to.  search 
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through  Ms  or  her  work  product  or  documentary  materials  in  order  to  find  and  seize  evidence. 

To  preserve  the  confidentiality  of  these  designated  materials,  the  PPA  instructs  investigators  not 
to  search  for  the  evidence  at  ail,  hut  to  compel  the  innocent  third  parties  to  find  and  produce  it 
themselves.  This  goal  of  Congress  remains  unchanged,  and  our  amendments  do  not  alter  this 
protection  for  innocent  third  parties. 

Congress  never  intended,  however,  to  protect  criminals  from  court-authorized  searches, 
and  the  legislative  history  to  the  PPA  is  replete  with  statements  to  this  effect.  For  example,  the 
Senate  Judiciary  Committee  Report  stated  that  the  purpose  of  the  PPA  is  to  "limit  searches  for 
materials  held  by  persons  involved  in  First  Amendment  activities  who  are  themselves  not 
suspected  ofparrieipation  in  the  criminal  activity  for  which  the  materials  are  sought."  $.  Rep. 

No,  96-874, 96th  Cong.,  2d  Sess.  1 1 (19S0),  reprinted  in  1980  U.S.C.C.A.N.  3950,  3957 
(emphasis  added).  Moreover,  the  Committee  Report  stated  that  the  intention  in  enacting  the  PPA 
was  "not  to  limit  the  ability'  of  law  enforcement  officers  to  search  for  and  seize  materials  held  by 
those  suspected  of  committing  the  crime  under  investigation."  M.  Indeed,  the  language  of  the 
statute  itself  allows  searches  and  seizures  of  any  person  who  “has  committed  or  is  committing 
the  criminal  offense  to  which  the  materials  relate”  42  U.S.C.A.  § 2000aa(a){l),  (b)(1).  Plainly, 
Congress  had  no  desire  to  inhibit  law  enforcement  investigators  that  need  to  search  the  premises 
of  a suspected  wrongdoer. 


item  of  commingling  of  protected  documents  and  evidence 


Because  Congress  enacted  this  statute  before  the  widespread  proliferation  of  computers, 
it  could  not  fully  consider  the  problem  raised  by  the  commingling  of  protected  information  and 
contraband,  .Although  commingling  can,  of  course,  occur  with  paper  records  — for  example,  if  a 
reporter  engaging  in  tax  fraud  placed  a copy  of  the  fraudulent  tax  return  in  a filing  cabinet  with 
his  or  her  work-related  notes  — such  commingling  never  presented  a significant  problem  for  two 
reasons.  First,  the  statute  applied  only  to  members  of  the  traditional  media,  a limited  group  not 
usually  associated  with  committing  crimes.  Second,  when  searching  for  paper  records, 
investigators  can  generally  examine  records  on  site  and  then  seize  only  those  records  that  are  the 
subject  of  their  warrant.  Thus,  investigators  can  avoid  violating  the  PPA  by  not  “searching  for” 
or  “seizing"  any  protected  material  since  they  do  not  need  to  cany  away  anythin e but  the  object 
of  their  search." 


With  the  widespread  use  of  computers  and  the  Internet,  however,  both  of  these  limiting 
factors  have  disappeared.  First,  every  computer  user  has  become  a potential  publisher.  For 
example,  a single  computer  can  provide  (I)  an  electronic  “bulletin  board"  for  the  posting  of  news 
items  by  individuals  using  the  Internet;  (2)  user  accounts  where  private  individuals  can  store 
drafts  of  news  items  that  they  intend  to  post  on  the  “bulletin  board";  and  (3)  a website  from 


Of  course,  investigators  may  briefly  isolate  or  possess  protected  material  during 
the  execution  of  the  warrant,  but  such  possession  occurs  during  the  execution  of  every  search" 
warrant  and  does  npt  constitute  a seizure. 

Privacy  Protection  Act  rat 

Page  6 of  10  Fa&fs 


1 


which  anyone  with  access  to  the  Internet  could  view  or  download  child  pornography.  Although 
the  second  category  of  data  arguably  constitutes  “work  product”  under  the  PPA,5  law 
3 enforcement  officials  plainly  have  the  duty  to  search  for  and  seize  the  third  category  of  data, 

5 Second,  potential  liability  under  the  PPA  may  arise  for  law  enforcement  officials  in  such 

a scenario  because  it  has  become  both  unreasonable  and  impractical  and  in  some  instances 
7 technically  impossible  to  search  for  and  seize  the  contraband  without  simultaneously  seizing 

protected  material.  In  the  new  electronic  environment,  where  computer  systems  with  gigabytes 
9 of  storage  have  become  ubiquitous,  law  enforcement  agents  generally  cannot  extract  legally 

seizable  evidence  from  commingled  protected  material  without  actually  seizing,  at  least 
11  temporarily,  those  protected  materials,  or,  perhaps  more  intrusively,  without  moving  into  and 
occupying  the  search  premises  for  extended  durations.  Because  of  the  volume  of  data  to  be 
13  searched  or  because  of  technical  concerns  (e.g.  encryption),  law  enforcement  agents  must  very 
often  remove  the  seized  computer  or  an  exact  copy  of  aB  the  data  to  a laboratory  for  analysis. 

15 

Moreover,  liability  may  attach  In  such  cases  because  the  prohibition  on  searching  for  or 
1 7 seizing  materials  is  stated  in  the  disjunctive;  violations  may  lie  either  for  searching  for  or 
seizing  such  materials.  Thus  even  a temporary  seizure  or  examination  may  result  in  liability', 

19  despite  the  fact  that  such  a PPA  violation  lies  far  outside  the  scope  of  the  issues  raised  by  the 
Zurcher  decision.  Zurcher  involved  a search  of  a newspaper  office,  and  the  warrant  was  drawn 
21  to  intentionally  seize  photographs  that  had  been  made  in  contemplation  of  publicat  ion.  The 

PPA,  designed  to  address  the  Zurcher  decision,  accordingly  should  deter  law  enforcement  from 
2 3 intentionally  searching  for  evidentiary  materials  in  the  possession  of  innocent  third  parties 

engaged  in  information  dissemination.  But  making  unlawful  the  reasonable  but  incidental 
2 5 seizure  of  PPA-protected  materials  pursuant  to  an  otherwise  lawful  search  or  seizure  carries  no 

similar  deterrent  effect,  and  it  contravenes  the  clearly  stated  intent  of  Congress  to  neither  shield 
27  criminals  nor  unduly  hinder  law  enforcement  efforts. 

2 9 (c)  Problems  faced  by  law'  enforcement 

3 1 The  potential  — and  unpredictable  — liability  inadvertently  created  by  the  PPA  has 

inhibited  the  investigation  and  prosecution  of  crimes  committed  using  computers.  For  example, 

3 3 individuals  have  used  computers  to  distribute  child  pornography,  copyrighted  software,  and 

stolen  credit  card  numbers  over  ordinary  phone  lines  and  the  Internet.  Some  of  these  individuals 
3 5 have  attempted  to  use  the  PPA  to  shield  their  illegal  activities  by  intentionally  storing  PPA- 

protected  materials  on  the  same  storage  devices  that  they  use  for  their  illegal  activities.  Indeed, 

3 7 law  enforcement  agents  have  encountered  individuals  using  computers  for  illegal  activities  that 
have  posted  the  following  message  on  their  sign-on  screens: 


No  court  has  vet  held  that  an  electronic  message,  posted  for  viewing  by  the  general  public  bv  way 
of  a Bulletin  Board  System  or  the  Internet,  constitutes  a “similar  torn  of  public  communication*  to  newspapers, 
books,  and  broadcasts  under  the  PPA.  Although  the  instant  amendments  to  the  PPA  do  not  opine  on  this  subject,  a 
court  might  make  this  ruling  if  presented  with  the  right  facts 
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NOTICE  TO  LAW  ENFORCEMENT  AGENTS: 

The  owners  and  users  of  this  system  are  exercising  First  Amendment  Rights 

Some  material  on  thus  system  is  in  preparation  for  public  dissemination  and  is 
"work  product  material"  protected  under  the  First  Amendment  Privacy  Protection 
Act  of  1980 ....  Each  and  every  person  who  has  such  "work  product  material" 
stored  on  this  system  is  entitled  to  recover  at  least  minimum  damages  of  $1000 

*plus  all  legal  expenses* While  the  agency  you  work  for  * might*  pay  your 

legal  fees  .and  judgments  against  you,  why  take  chances? 


The  language  "[sjorae  material  on  this  system"  is  extremely  significant.  It  is  seldom  the  case 
that  a computer  is  used  solely  for  illegal  purposes  such  as  the  distribution  of  contraband.  Were 
this  the  case,  the  computer  and  the  evidence  it  contains  could  be  seized  without  regard  to  the 
PPA,  since  contraband  is  specifically  excluded  from  the  definitions  of  work  product  and 
documentary  materials.  42  U.S.C.  § 2Q0Gaa-7(a)  (defining  "documentary  materials");  42  U.S.C. 
§ 2000aa-7(b)  (defining  "work  product  materials").  In  most  cases,  only  certain  portions  of  a 
website  or  electronic  bulletin  board  will  be  set  aside  for  illegal  activities,  while  other  portions  are 
used  for  completely  legal  activities  such  as  the  legitimate  distribution  of  information.  As  the 
quoted  language  makes  clear,  however,  criminals  are  well  aware  that  under  the  PPA,  protected 
materials  can  be  used  to  shield  contraband  from  search  and  seizure.  Congress,  of  course,  never 
intended  to  shield  contraband  when  it  enacted  the  PPA. 

Moreover,  in  addition  to  exposing  law  enforcement  to  unintended  liability,  the  PPA,  as  it 
stands,  creates  unnecessary  problems  during  the  execution  of  warrants,  problems  that  potentially 
harm  the  health  and  safety'  of  the  public.  In  1999,  for  example,  Special  "Agents  of  the  Federal 
Bureau  of  Investigation  uncovered  a system  of  computers  used  to  proride  child  pornography  to 
anyone  with  access  to  the  Internet.  These  computers,  however,  also  provided  Internet  accounts 
to  third  parties,  many  of  whom  did  not  know  about  the  illegal  activities  of  the  computers’ 
operators.  These  unrelated  accounts  may  have  contained  material  protected  by  the  PPA.  The 
investigators  determined  that  it  would  be  impossible  to  search  the  computers  on  site  while  at  the 
same  rime  allowing  the  computers  to  continue  to  operate.  Thus,  in  an  effort  to  reduce  their 
potential  liability  under  the  PPA  for  seizing  the  third  party  accounts,  the  investigators  decided  to 
obtain  a search  warrant  authorizing  them  only  to  copy  the  computers’  stored  data  and  allow  the 
computers  to  continue  to  operate.  This,  of  course,  had  the  effect  of  allowing  the  child 
pornography  to  remain  accessible  to  the  public  — and  possibly  even  allowing  the  pomographers 
or  their  confederates  to  copy  the  images  to  an  unknown  computer  — while  computer  experts 
reviewed  the  data  to  segregate  the  illegal  files.  Congress  never  intended  to  hamper  law 
enforcement  efforts  in  this  way. 


41  (d)  The  solution 


43 


While  the  PPA  must  be  amended  so  that  it  does  not  shield  child  pomographers, 
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copyright  infringers,  and  other  criminals,  such  amendments  should  not  inhibit  those  activities 
that  the  PPA  was  designed  to  protect.  Indeed,  the  importance  of  protecting  the  confidentiality  of 
these  sensitive  materials  remains  as  great  today  as  it  has  ever  been.  Thus,  the  law  should  limit 
the  intrusiveness  of  government  searches  but  should  not  unnecessarily  hinder  Saw  enforcement's 
efforts  to  enforce  the  criminal  laws  . The  language  of  this  bill  achieves  this  delicate  balance 
between  important  values. 

The  bill’s  new  provisions.  Title  42,  United  States  Code,  sections  2Q0Qaa(a)(3)  and 
2000aa(b)(5),  make  it  clear  that  law  enforcement  agents  may  still  search  for  or  seize  contraband, 
instrumentalities,  and  evidence  not  protected  by  the  PPA,  even  if  work  product  or  d ocumentary 
material  may  Incidentally  be  examined  or  seized  during  a search.  It  is  Important  to  note, 
however,  that  where  ait  innocent  third  party  possesses  the  items  sought,  and  if  the  items  sought 
are  commingled  with  work  product  or  documentary  materials,  existing  regulations  already 
require  investigators  to  avoid  using  a search  warrant  or  subpoena  where  less  intrusive  means  are 
appropriate,  gee,  &g„  28  C.F.R.  50, 10  (requiring  Justice  Department  officials  to  use  all  other 
mean  s available  to  obtain  informati  on  before  issuing  subpoena  to  member  of  the  news  m edia); 

28  C.F.R.  §59.4(a)  and  28  C.F.R,  §59,4(c)(l)(n)  (in  determining  whether  to  use  a warrant  or 
subpoena  to  obtain  documentary  materials,  an  attorney  for  the  government  should  consider 
whether  there  is  a dose  relationship  of  friendship,  loyalty,  o r sympathy  between  the  possessor  of 
the  materials  and  a suspect).  Thus,  even  though  the  PPA  would  not  restrict  such  incidental 
seizures,  the  Committee  believes  that  government  agents  will  need  to  consider  what  method  is 
proper  for  obtaining  the  evidence  based  upon  the  facts  of  the  case  at  hand. 

Although  these  amendments  to  the  PPA  address  the  problem  of  incidental  searches  or 
seizures,  these  changes  do  not  in  any  way  alter  the  statute's  effect  in  cases  like  Zurcber.  The  law' 
enforcement  officials  who  searched  The  Stanford  Daily — which  was  not  involved  in  any 
criminal  activity  — sought  the  very  documentary  materials  that  the  PPA  now  protects.  These 
materials,  therefore,  were  not  “incidental”  to  the  search,  and  they  therefore  would  not  meet  the 
exception  found  in  the  new  amendments.  Thus,  even  under  the  new  law,  when  law  enforcement 
agents  encounter  a situation  like  that  in  the  Zurcher  case,  they  will  still  have  to  use  a subpoena  as 
the  original  PPA  directed. 

But  in  other  cases,  where  the  search  is  “otherwise  lawful”  (i.e.  the  object  of  the  search  is 
something  other  than  “work  product”  or  “documentary"  materials),  these  amendments  to  the 
PPA  will  ensure  that  investigators  can  carry  out  their  duties,  even  when  PPA-protecied  materials 
may  be  commingled  with  seizable  ones.  The  amendments’  use  of  the  term  "incidental"  clearly 
prohibits  situations  in  which  protected  materials  are  the  object  of  the  search.  The  term 
"incidental,"  which  appears  in  other  statutes  (see,  18  U.S.C.  §2510(17)),  means  something 
which  is  "occurring  or  likely  to  occur  at  the  same  time  or  as  a consequence."6  Accordingly,  in' 
order  to  be  "incidental"  within  the  intent  of  this  provision,  any  search  or  seizure  of  protected 
materials  would  have  to  be  a concomitant  consequence  of  a search  for  materials  not  protected  by 

6 The  American  Heritage  Dictionary,  Second  College  Edition  ( 1 9S9) 
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1 the  PPA.7 

3 Additionally,  of  course,  the  link  between  the  incidental  items  and  the  lawful  object  of  the 

search  or  seizure  must  be  reasonable  on  the  facts  of  the  case.  This  requir  ement  that  such  a 
5 search  be  reasonable  is  directly  analogous  to  the  Fourth  Amendment  requirement  of 

reasonableness  both  in  the  scope  of  a search  warrant  and  in  its  execution.  See  O'Connor  v. 

7 Ortega,  480  U.S.  709,  726  (1987);  United  States  v.  Henson.  848  F,2d  1374  (6th  Or.  1988); 

United  States  v.  Tamura.  694  F.2d  591  (9th  Cm  1982).  Cases  that  have  nothing  to  do  with  the 
9 PPA  have  caused  courts  to  wrestle  with  whether,  under  all  the  facts  and  circumstances,  seizing 
certain  incidentai  materials  was  sufficiently  reasonable  to  meet  the  Fourth  Amendment  standard. 
11  Thus,  'the'ameridmenis  do  not,  by  any  means,  invite  law  enforcement  to  use  "an  otherwise 
lawful"  search  as  a pretext  for  an  unreasonable  rummaging  of  other  do  cuments  — whether 
13  protected  by  the  PPA  or  not.  On  the  contrary,  this  new  exception  to  the  PPA  will  allow  courts  to 
apply  existing  and  well-established  Fourth  Amendment  jurisprudence  in  analyzing  the  analogous 
15  question  of  whether  arty  incidental  search  or  seizure  of  PPA-protected  materials  has  been 
reasonable  under  the  circumstances. 

17 


7 This  provision  docs  not,  of  course,  require  that  die  incidental  seizure  of  protected  materials  be 
inadvertent:  law  enforcement  oSlcers  may  knowingly  seize  protected  materials  where  such  seizure  is  incidental  so  a 
lavvtui  search. 
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Executive  Summary 


Amendments  Creating  a “Clean  Hands’’  Exception  to  Provisions  Statutorily  Mandating  the 
Suppression  of  Illegally  Intercepted  Communications. 


The  accompanying  amendments  would  create  a “dean  hands”  exception  to  the  statutory 
suppression  mandates  of  IS  U.S.C.  §2515  governing  the  use  and  introduction  of  illegally 
intercepted  wire  or  oral  communications.  The  proposal  would  allow  for  the  use  in  a criminal 
investigation  and  the  introduction  into  evidence  in  criminal  matters  of  communications 
otherwise  illegally  intercepted  by  persons  other  than  law  enforcement,  ONLY  if  law  enforcement 
was  neither  directly  or  indirectly  involved  in  its  acquisition.  Not  unlike  the  rationale  supporting 
the  “good  faith”  exception  to  the  Fourth  Amendment’s  exclusionary  remedies,  implicit  in  the 
proposed  amendment  is  the  determination  that  the  truth-finding  functions  of  the  criminal  process 
are  paramount  when  there  is  little  or  no  law  enforcement  deterrence  effect  achievable.  In 
contrast  to  existing  law  which  prohibits  ail  use,  the  proposed  amendment  would  allow  the 
introduction  of  such  evidence  both  when  it  is  inculpatory  or  exculpatory  in  nature. 
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“Clean  Hands”  Exception  to  Statutory  exclusionary  Rule 

(Exclusive  of  Other  Substantive  Amendments) 

Section  25 1 5.  Prohibition  of  use  as  evidence  of  intercepted  wire  or  oral  communications 

(a)  Exbept  insubsectlpa  Wheaevee  any  or  oral  communication 

has  been  intercept^,  no  part  of  the  contents  of  such  communication  and  no  evidence  derived 
therefrom  may  be  received  in  evidence  in  any  trial,  bearing,  or  other  proceeding  in  or  before  any 
court,  grand  jury,  department,  officer,  agency,  regulatory  body,  legislative  committee,  or  other 
authority  of  the  United  States,  a State,  or  a political  subdivision  thereof  if  the  disclosure  of  that 
information  would  be  in  violation  of  this  chapter. 
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Section  2 517.  Authorization  for  disclo  sure  and  use  of  intercepted  wire,  oral,  or  electronic 
25  communications 


27  { 1 ) Any  investigative  or  law  enforcement  officer  who,  by  any  means  authorized  by  this  chapter 

has  obtained  knowledge  of  the  contents  of 

2 9 any  wire,  oral,  or  electronic  communication,  or  evidence  derived  therefrom,  may  disclose  such 
contents  to  another  investigative  or  law  enforcement  officer  to  the  extent  that  such  disclosure  is 

31  appropriate  to  the  proper  performance  of  the  official  duties  of  the  officer  making  or  receiving  the 

disclosure. 

33 

(2)  Any  investigative  or  law  enforcement  officer  who,  by  any  means  authorized  by  this  chapter 
35  has  obtained  knowledge  of  the  contents  of 

any  wire,  oral,  or  electronic  communication  or  evidence  derived  therefrom  may  use  such 
37  contents  to  the  extent  such  use  is  appropriate  to  the  proper  performance  of  his  official  duties, 

39  (3)  Any  person  who  has  received,  by  any  means  authorized  by  this  chapter,  any  information 

concerning  a wire,  oral,  or  electronic  communication,  or  evidence  derived  therefrom  intercepted 
41  in  accordance  with  the  provisions  of  this  chapter  may  disclose  the  contents  of  that 

communication  or  such  derivative  evidence  while  giving  testimony  under  oath  or  affirmation  in 
4 3 any  proceeding  held  under  the  authority  of  the  United  States  or  of  any  State  or  political 
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(4)  No  otherwise  privileged  wire,  oral,  or  electronic  communication  intercepted  in  accordance 
with,  or  in  violation  of,  the  provisions  of  this  chapter  shall  lose  its  privileged  character, 

(5)  When  an  investigative  or  law  enforcement  officer,  while  engaged  in  intercepting  wire,  oral, 
or  electronic  communications  in  the  manner  authorized  herein,  intercepts  wire,  oral,  or  electronic 
communications  relating  to  offenses  other  than  those  specified  in  the  order  of  authorization  or 
approval,  the  contents  thereof  and  evidence  derived  therefrom,  may  he  disclosed  or  used  as 
provided  in  subsections  (I)  and  (2)  of  this  section.  Such  contents  and  any  evidence  derived 
therefrom  may  be  used  under  subsection  (3)  of  this  section  when  authorized  or  approved  by  a 
judge  of  competent  jurisdiction  where  such  judge  finds  on  subsequent  application  that  the 
contents  were  otherwise  intercepted  in  accordance  with  the  provisions  of  this  chapter.  Such 
application  shall  be  made  as  soon  as  practicable. 


Section  25 1 8.  Procedure  for  interception  of  wire,  oral,  or  electronic  communications 

(1)  Each  application  for  an  order  authorizing  or  approving  the  interception  of  a wire,  oral,  or 
electronic  communication  under  this  chapter  shall  be  made  in  writing  upon  oath  or  affirmation  to 
a judge  of  competent  jurisdiction  and  shall  st  ate  the  applicant's  authority  to  make  such 
application.  Each  application  shall  include  the  following  information: 

(a)  the  identity  of  the  investigative  or  law  enforcement  officer  making  the  application, 
and  the  officer  authorizing  the  application; 

(b)  a mil  and  complete  statement  of  the  facts  and  circumst  ances  relied  upon  by  the 
applicant,  to  justify  his  belief  that  an  order  should  be  issued,  including  (i)  details  as  to  the 
particular  offense  that  has  been,  is  being,  or  is  about  to  he  committed,  (ii)  except  as 
provided  in  subsection  (1 1),  a particular  description  of  the  nature  and  location  of  the 
facilities  from  which  or  the  place  where  the  communication  is  to  be  intercepted,  (hi)  a 
particular  description  of  theftype  of  communications  sought  to  be  intercepted,  (iv)  the 
identity  of  the  person,  if  known,  committing  the  offense  and  whose  communications  are 
to  be  intercepted; 

(c)  a full  and  complete  statement  as  to  whether  or  not  other  investigative  procedures  have 
been  tried  and  failed  or  why  they  reasonably  appear  to  be  unlikely  to  succeed  if  tried  or 
to  be  too  dangerous; 

(d)  a statement  of  the  period  of  time  for  which  the  interception  is  required  to  be 
maintained.  If  the  nature  of  the  investigation  is  such  that  the  authorization  for 
interception  should  not  automatically  terminate  when  the  described  type  of 
communication  has  been  first  obtained,  a particular  description  of  facts  establishing 
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probable  cause  to  believe  that  additional  communications  of  the  same  type  will  occur 
thereafter; 

(e)  a foil  and  complete  statement  of  the  facts  concerning  all  previous  applications  known 
to  the  individual  authorizing  and  making  the  application,  made  to  any  judge  for 
authorization  to  intercept,  or  for  approval  of  interceptions  of,  wire,  oral,  or  electronic 
communications  involving  any  of  the  same  persons,  facilities  or  places  specified  in  the 
application,  and  the  action  taken  by  the  judge  on  each  such  application;  and 

(f)  where  the.application  is  for  the  extension  of  an  order,  a statement  setting  forth  the 
results  thus  far  obtained  from  the  interception,  or  a reasonable  explanation  of  the  failure 
to  obtain  such  results. 


(2)  The  judge  may  require  the  applicant  to  furnish  additional  testimony  or  documentary  evidence 
in  su  pport  of  the  application, 

(3)  Upon  such  application  the  judge  may  enter  an  ex  parte  order,  as  requested  or  as  modified, 
authorizing  or  approving  interception  of  wire,  oral,  or  electronic  communications  within  the 
territorial  jurisdiction  of  the  court  in  which  the  judge  is  sitting  (and  outside  that  juri  sdiction  but 
within  the  United  St  ates  in  the  case  of  a mobile  int  erception  device  authorized  by  a Federal  court 
within  such  jurisdiction),  if  the  judge  determines  on  the  basis  of  the  facts  submitted  by  the 
applicant  that— 


(a)  there  is  probable  cause  for  belief  that  an  individual  is  committing,  has  committed,  or 
is  about  to  commit  a particular  offense  enumerated  in  section  2516  of  this  chapter; 

i 

(b)  there  is  probable  cause  for  belief  that  particular  communications  concerning  that 
offense  will  be  obtained  through  such  interception; 

(c)  normal  Investigative  procedures  have  been  tried  and  have  failed  or  reasonably  appear 
to  be  unlikely  to  succeed  if  tried  or  to  be  too  dangerous; 

(d)  except  as  provided  in  subsection  (1 1),  there  is  probable  cause  for  belief  that  the 
facilities  from  which,  or  the  place  where,  the  wire,  oral,  or  electronic  communications  are 
to  be  intercepted  are  being  used,  or  are  about  to  be  used,  in  connection  with  the 
commission  of  such  offense,  or  are  leased  to,  listed  in  the  name  of,  or  commonly  used  by 
such  person, 

(4)  Each  order  authorizing  or  approving  the  interception  of  any  wire,  oral,  or  electronic 
communication  under  this  chapter  shall  specify— 


(a)  the  identity  of  the  person,  if  known,  whose  communications  are  to  be  intercepted; 
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(b)  the  nature  and  location  of  the  communications  facilities  as  to  which,  or  the  place 
where,  authority  to  intercept  is  granted, 

(c)  a particular  description  of  the  type  of  communication  sought  to  be  intercepted,  and  a 
statement  of  the  particular  offense  to  which  it  relates; 

(d)  the  identity  of  the  agency  authorized  to  intercept  the  communications,  and  of  the 
person  authorizing  the  application;  and 

(e)  the  period,  of  time  during  which  such  interception  is  authorized,  including  a statement 
as  to  whether  or  not  the  interception  shall  automatically  terminate  when  the  described 
commumcation  has  been  first  obtained 

An  order  authorizing  the  interception  of  a wire,  oral,  or  electronic  communication  under  this 
chapter  shall,  upon  request  of  the  applicant,  direct  that  a provider  of  wire  or  electronic 

“ tr  f ^ lantfior^  custodian  or  other  person  shah  furnish  the  applicant  forthwith 
au  miormation,  facilities,  and  technical  assistance  necessary'  to  accomplish  the  interception 
unobtrusively  and  with  a minimum  of  interference  with  the  services  that  such  service  provider 
n or  , custodian  or  person  is  according  the  person  whose  communications  are  to  be 
intercepted.  Any  provider  of  wire  or  electronic  communication  service,  landlord,  custodian  or 
other  person  tailing  such  facilities  or  technical  assistance  shall  be  compensated  therefor  bv 
B e app  icant  ^0r  reasona^^e  exPenses  tocurred  in  providing  such  facilities  or  assistance, 
ursuant  to  section  2522  of  this  chapter,  an  order  may  also  be  issued  to  enforce  the  assistance 
capability  and  capacity  requirements  under  the  Communications  Assistance  for  Law 
Enforcement  Act. 

(5)  No  order  entered  under  this  section  may  authorize  or  approve  the  interception  of  any  wire 
oral,  or  electronic  communication  for  any  period  longer  than  is  necessary-  to  achieve  the 
objective  of  the  authorization,  nor  in  any  event  longer  than  thirty  days.  Such  thirty-day  perio  d 
begins  on  the  earlier  of  the  day  on  which  the  investigative  or  law  enforcement  officer  first  begins 

ort«v “f"  ""  °*r  °r.  “ aays  aft'r  ,he  or<ier  is  Extensions  of  an 

may  be  granted,  but  only  upon  application  for  an  extension  made  in  accordance  with 

su  sectional)  of  this  section  and  the  court  making  the  findings  required  by  subsection  (3)  of  this 

TIT  Pen°d  of  ef  ™ shaiI  be  » ^nger  the  authorizing  judge  deems  necessary 

p achjevJ the  Purposes  for  which  it  was  granted  and  in  no  event  for  longer  than  thirty  days 
Every  order  and  extension  thereof  shall  contain  a provision  that  the  authorization  to  intercom 
, be  executed  as  soon  as  practicable,  shall  be  conducted  in  such  a way  as  to  minimize  the 
interception  of  communications  not  otherwise  subject  to  interception  under  this  chapter  and 
must  terminate  upon  attainment  of  the  authorized  objective,  or  in  any  event  in  thirty  davs  in  t he 
event  the  intercepted  communication  is  in  a code  or  foreign  language,  and  an  expert  in  that 
oreip  language  or  code  is  not  reasonably  available  during  the  interception  period,  minimization 
may  be  accomplished  as  soon  as  practicable  after  such  interception.  An  interception  under  this 
chapter  may  be  conducted  m whole  or  in  part  by  Government  personnel,  or  bv  an  individual 
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operating  under  a contract  with  the  Government,  acting  under  the  supervision  of  an  investigative 
or  law  enforcement  officer  authorized  to  conduct  the  interception. 


require  repons  to  be  made  t o the  judge  who  issued  the  order  showing  what  progress  has  been 
made  toward  achievement  of  the  authorized  objective  and  the  need  for  cont  inued  interception. 
Such  reports  shall  be  made  at  such  intervals  as  the  judge  may  require. 

(/)  Notwithstanding  any  other  provision  of  this  chapter,  any  investigative  or  law  enforcement 
officer,  specially  designated  by  the  Attorney  General,  the  Deputy  Attorney  General,  the 
Associate  Attorney  General  or  by  the  principal  prosecuting  attorney  of  anv  State  or  subdivision 
thereof  acting  pursuant  to  a statute  of  that  State,  who  reasonably  d etermines  that- 


(a)  an  emergency  situation  exists  that  involves— 

(i)  immediate  danger  of  death  or  serious  physical  injury  to  any  person, 

(ii)  conspiratorial  activities  threatening  the  national  security  interest,  or 
(id)  conspiratorial  activities  characteristic  of  organized  crime 

that  requires  a wire,  oral,  or  electronic  communication  to  be  intercepted  before  an  order 
authorizing  such  interception  can,  with  due  diligence,  be  obtained,  and 

(b)  there  are  grounds  upon  which  an  order  could  be  entered  under  this  chapter  to 
authorize  such  interception. 


may  intercept  such  wire,  oral,  or  electronic  communication  if  an  application  for  an  order 
approving  the  interception  is  made  in  accordance  with  this  section  within  forty-eight  hours  after 
intercept™ , has  ocean*  or  begins  .0  occur,  lo  rhe  ,bs«e  of  anord^  suSSta 
shall  immediately  terminate  when  the  communication  sought  is  obtained  or  when  the  anplicaticn 

i WhitheW  iS  b lh'  Sucb  w"rado'> for  «*ov,Hs  denied. 

rA  'h  case  where  the  Perception  is  terminated  without  an  order  having  been  issued  the 

contents  of  any  wire,  oral,  or  electronic  communication  intercepted  shall  be  treated  as  having’ 
seen  ob  tained  in  violation  of  this  chapter,  and  an  inventory  shall  be  served  as  provided  for  in' 

subsection  |||(d)  of  this  section  on  the  person  named  in  the  application, 

(a)  The  contents  of  any  wire,  oral,  or  electronic  communication  intercepted  by  anv  mean  s 
authorized  by  this  chapter  shall,  if  possible,  be  recorded  on  tape  or  wire  or  other  " 
comparable  device.  The  recording  of  the  contents  of  any  wire,  oral,  or  electronic 
communication  under  this  subsection  shall  be  done  in  such  way  as  will  protect  the 
recording  from  editing  or  other  alterations,  immediately  upon  the  expiration  of  the 
period  of  the  order,  or  extensions  thereof,  such  recordings  shall  be  made  available  to  the 
judge  issuing  such  order  and  sealed  under  his  directions.  Custody  of  the  recordings  shall 
be  wherever  the  judge  orders.  They  shall  not  be  destroyed  except  upon  an  order  of  the 
issuing  or  denying  judge  and  in  any  event  shall  be  kept  for  ten  years.  Duplicate 
recordings  may  be  made  for  use  or  disclosure  pursuant  to  the  provisions  of  subsections 


(8) 
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provided  for  by  this  subsection,  or  a satisfactory  explanation  tor  the  absence  thereof, 

3 shall  be  a prerequisite  for  the  use  or  disclosure  of  the  contents  of  any  wire,  oral,  or 

electronic  communication  or  evidence  derived  therefrom  under  subsection  (3)  of  section 
5 2517. 
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(b)  Applications  made  and  orders  granted  under  this  chapter  shall  be  sealed  by  the  judge. 
Custody  of  the  applications  and  orders  shall  he  wherever  the  judge  directs.  Such 
applications  and  orders  shall  be  disclosed  only  upon  a showing  of  good  cause  before  a 

. judge  of  competent  jurisdiction  and  shall  not  be  destroyed  except  on  order  of  the  issuing 
or  denying  judge,  and  in  any  event  shall  be  kept  for  ten  years. 

(c)  Any  violation  of  the  provisions  of  this  subsection  may  be  punished  as  contempt  of  the 
issuing  or  denying  judge. 

(d)  Within  a reasonable  time  but  not  later  than  ninety  days  after  the  filing  of  an 
application  for  an  order  of  approval  under  section  2538(7)(b)  which  is  denied  or  the 
temunation  of  the  period  of  an  order  or  extensions  thereof  the  issuing  or  denying  judge 
shall  cause  to  be  served,  on  the  persons  named  in  the  order  or  the  application,  and  such 
other  parties  to  intercepted  communications  as  the  judge  may  determine  tn  Ms  discretion 
that  is  in  the  interest  of  justice,  an  inventory  which  shall  Include  notice  of~~ 

(1)  the  fact  of  the  entry  of  the  order  or  the  application; 

(2j  the  date  of  the  entry  and  the  period  of  authorized,  approved  or  disapproved 
interception,  or  the  deni  al  of  the  application;  and 

(3)  the  fact  that  during  the  period  wire,  oral,  or  electronic  communications  were 
or  were  not  intercepted. 

The  judge,  upon  the  filing  of  a motion,  may  in  his  discretion  make  available  to  such  person  or  his 
counsel  for  inspection  such  portions  of  the  intercepted  communications,  applications  and  orders' 
as  the  judge  determines  to  be  in  the  interest  of  justice.  On  an  ex  parte  showing  of  good  cause  to 

a judge  of  competent  jurisdiction  the  serving  of  the  inventory  required  by  this  subsection  mav  be 
postponed. 

(9)  The  contents  of  any  wire,  oral,  or  electronic  communication  intercepted  pursuant  to  this 
chapter  or  evidence  derived  therefrom  shall  not  be  received  in  evidence  or  otherwise  disclosed  in 
any  trial,  hearing,  or  other  proceeding  in  a Federal  or  State  court  unless  each  party,  not  less  than 
ten  days  before  the  trial,  hearing,  or  proceeding,  has  been  furnished  with  a copy  of  the  court 
order,  and  accompanying  application,  under  which  the  interception  was  authorized  or  approved. 
This  ten-day  period  may  be  waived  by  the  judge  ifhe  finds  that  it  was  not  possible  to  furnish  the 
party  with  the  above  information  ten  days  before  the  trial,  hearing,  or  proceeding  and  that  the 
party  will  not  be  prejudiced  by  the  delay  In  receiving  such  information. 


(10)  (a)  Any  aggrieved  person  in  any  trial,  hearing,  or  proceeding  in  or  before  any  court. 
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department,  officer,  agency,  regulatory  body,  or  other  authority'  of  the  United  States,  a 
State,  or  a political  subdivision  thereof,  may  move  to  suppress  the  contents  of  any  wire  or 

oral  communication  intercepted  pursuant  to  this  chapter,  or  evidence  derived  therefrom 
on  the  grounds  that-  " ? 

(i)  the  communication  was  unlawfully  intercepted; 

(ii)  the  order  of  authorization  or  approval  under  which  it  was  intercepted  is 
insufficient  on  its  face;  or 


(iii)  the  interception  was  not  made  in  conformity  with  the  order  of  authorization 
or  approvafc§ 

^ ^ £d^oJn  sliadi^e  miaide  sin^^Sj^aring^'^r  proceSn|^i23£e 
was  no  opportunity  to  make  such  motion  or  the  person  was  not  aware  of  the  grounds  of 
the  motion.  If  the  motion  is  graated,|the  contents  of  the  intercepted  wire  or  oral 
communication,  or  evidence  derived  therefrom,  shall  be  treated  as  having  been  obtained 
m violation  of  this  chapter.  The  judge,  upon  the  filing  of  such  motion  by  the  aggrieved 
person,  may  m his  discretion  make  available  to  the  aggrieved  person  or  Ms  counsel  for 
inspection  such  portions  of  the  intercepted  communication  or  evidence  derived  therefrom 

as  the  judge  determines  to  be  in  the  interests  of  justice. 


(b)  In  addition  to  any  other  right  to  appeal,  the  United  States  shall  have  the  right  to 
appeal  from  an  order  granting  a motion  to  suppress  made  under  paragraph  {af  of  this 
subsection,  or  the  denial  of  an  application  for  an  order  of  approval,  if  the  United  States 
attorney  shall  certify  to  the  judge  or  other  official  granting  such  motion  or  denying  such 
application  that  the  appeal  is  not  taken  for  purposes  of  delay.  Such  appeal  shall  be  taken 
within  thirty  days  after  the  date  the  order  was  entered  and  shall  be  diligently  prosecuted. 


(g  The  remedies  and  sanctions  described  in  this  chapter  with  respect  to  the  interception 
or  electronic  communication  are  the  only  judicial  remedies  and  sanctions  for  non- 
constitutional violations  of  this  chapter  involving  such  communications. 
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“Clean  Hands”  Exception  Proposed  Legislative  History 

Inapplicability  of  18  US,C.  §2515  statutory  exclusion  and  non-use  of  certain  “clean 
hands”  good  faith  disclosures 

This  proposed  change  makes  a carefully  limited  amendment  of  18  U S C §?51  5 the 
statutory  exclusionary-  rule  for  violations  of  Title  Hi  of  the  Omnibus  Crime  Controfand  Safe 
Streets  Act  of  1968,  so  as  clearly  to  exempt  two  situations:  (1)  those  in  which  private  individuals 
illegally  intercept  or  record  a communication,  but  the  recording  later  comes  into  the  possession 
or  a party  m a comma!  trial,  who  then  wishes  of  introduce  it;  and  (2)  those  in  which  an 

'v'101ateS,ehapt5  1 19  {e  g\> by  ^ging  in  an  illegal  wiretap)  and  the  government 
tnereatter  seeks  of  use  the  communication  to  prosecute  that  violator. 

At  present,  appellate  decisions  are  in  apparent  conflict  over  whether  section  2515 

f^ZVbe  T ofco“cfons>  *e  category  described  above.  Under  one  possible 
0f^finJ.0n^.  ^Ctl0n,7'  lfa  PnJ3te  individual  consensu  ally  records  a conversation  in  aid 
of  an  illegal  activity,  or  illegally  records  a conversation  between  other  parties  without  their 
consent,  the  contents  of  such  recordings  are  not  admissible  in  a criminal  trial  or  hearing  even  if 
government  had  no  role  m having  the  evidence  recorded  and  only  acquired  it,  through  lawful 

not * iv  er  A ? SIt?f 0n  0CCUrS  because> under  !S  US  C-  §25 1 K2){d).  a consenting 

§ Under^l0r  0f  ,aw>  may  record  on3y  tf  the  wording  is  for  a non-criminal  or  ~ 

she  0^??  ffi  ■ TT °f a bdbe $eCretly  reCOfds  1316  transact5ofi  in  which  he  or 

h a f f l *?•  f6  S°Vemment  latcr  obtaks  t5ie  recording  ^d  seeks  of  use 

fcamst  the  official  of  prove  the  bnbe,  section  2515  arguably  precludes  such  use.  One 

appellate  court  has  so  held.  United  States  v.  Vest  813  F.2d  477  (1st  Cir.  1987) 

By  contrast,  another  appellate  court  has  held  that  section  2515  does  not  bar  the 
fr°m  Wordings  made  by  an  gambling  business  (of  bets  placed  by 

™th  bett0rs  over  **  ^nnts  of  their  bets.  Unitedly 
Lndgrh^i,  8b  F.2d  105  (6th  Cir.),  pert,  denied,  484  U.S.  821,  846  (1987).  While  the  court  in 
Vest  acknowledged  that  no  deterrent  purpose  would  be  served  by  suppression  because  the 

Tl?  JWO“  ,d“^*'°n^p"vai5'viola,ion-  The  corn  in  Underhill  0„ 

breadth  f ff  le»5lat«  UstOTy  Wicatag  that  Congress,  despite  the  facial 

of  section  -515,  did  not  intend  to  permit  lawbreakers  to  immunize  themselves  from 
prosecution  by  the  very  criminal  purposes  that  made  the  recordings  illegal 

The  same  disagreement  among  circuit  courts  exists  regarding  the  admissibility  of 

pmietln  nnde  **  ^ aft0fS^rc8Pt^  communications  without  the  consent  of  any  of  the 
P es.  In  one  case,  a court  barred  the  use  before  a grand  jury  of  such  illegally  intercepted 

communications.  See  In  re  Grand  Jurv.  m F3dl066fMr;r  l00?!  tWnm-tr  i t 

c«*n*t!v  imtatu  , 7-  T~~- 7 1 vir-  ay  contrast,  where  a wife 

thelmh  r ! recording  device  to  intercept  her  husband’s  conversations  with  other  persons, 
the  Sixth  Circuit  concluded  that  section  25 1 5 did  not  bar  the  use  of  the  contents  of  those 
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communications  in  a prosecution  of  the  husband,  given  the  government's  tack  of  involvement  tn 
the  original  interception.  See  United  States  v.  Murdock  63  F.3d  1391  (6&  Cir.  1995). 

WTiether  or  not  Vest  and  In  re  Grand  Jury  were  correctly  decided  under  the  existing 
statutory  provision,  an  exemption  should  be  created  under  section  2515  for  that  narrow  class  of 
cases  in  which  the  government  lawfully  obtains  illegal  recordings  made  by  private  parties  and 
seeks  to  use  them  as  evidence  in  a criminal  investigation,  proceeding,  hearing  or  trial,  or  before  a 
grand  jury.  The  truth-seeking  function  of  a criminal  proceeding  is  of  paramount  importance.  In 
the  absence  of  any  det  errent  purpose  to  be  saved  by  exclusion,  this  truth-seeking  function 
should  prevail  over  tire  concern  that  disclosure  in  the  criminal  proceeding  would  somehow 
exacerbate  the  original  illegal  recording. 

Conversely,  if  evidence  contained  in  an  illegally  intercepted  recording  tends  to  exculpate 
a defendant,  that  defendant  should  be  entitled  to  introduce  the  evidence  so  long  as  he  did  not 
participate  in  the  interception  in  any  way.  The  instant  amendment  thus  reflects  the  belief  that  a 
pnvate  violation  of  the  statute  should  not  trigger  the  severe  result  of  exclusion  of  otherwise 
probative  evidence  k a criminal  case  (just  as  the  Fourth  Amendment,  of  course,  does  not  'apply 
to  non-governmental  searches  and  seizures*).  Accordingly,  this  section  would  amend  section  * 
*.-15  to  expressly  exempt  such  disclosures  from  its  purview. 

In  addition,  the  amendment  would  also  darify  that  illegal  intercepts  made  be  used  for  the 
limited  purpose  of  prosecuting  the  individual  who  conducted  the  illegal  interception.  In  one 
recent  case,  United  States  v.  Once,  ^7  F,  Sapp.  2d  428  (D.  S.C.  1998),  an  employee  of  a county 
snentt  s department  illegally  intercepted  conversations  between  two  prisoners  and  their 
attorneys.  When  the  United  States  sought  to  use  the  recording  of  prosecute  that  violation,  the 
district  court  ruled  the  evidence  inadmissible.  The  amendment  would  permit  such  use  for  the 
purpose  of  prosecutkg  the  violator  of  chapter  1 19.  Conforming  amendments  are  also  made  of 
subsections  (3  ) and  (2)  of  section  2517  and  subsection  2518(10){a) . 


B 

The  history  of  section  25 1 5’s  original  enactment  makes  clear  that  Congress  intended  that  itanbodv 
ex^g  Fourth  Anwndment  fmdams.  SeeS.  Rep.  No.  1997,  Cong.  2d  Sess..  renrinwd  m 1968  U S, C C AN. 
v3  (no  intension  "of  press  vnt  scope  of  the  suppression  role  bey  ond  present  scorch  and  seizure  \m  '\ 
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Executive  Summary 

Amendment  Creating  Emergency  Pen  Register/Trap  & Trace  Authority  for  US  Attorneys 
and  Top  Law  Enforcement,  ' * 

Under  current  law,  1 S U.S.C.  § 3 125(a),  an  emergency  pen  register  or  trap  & trace  mav 
e aut  onzed  only  by  certain  high  level  DOI  officials  or  “any  investigative  or  law'  enforcement 
o cer  specially  designated  by  the  Attorney  General”  or,  In  cases  involving  the  States  the 
equivalent  of  the  County  District  Attorney.  Emergency  pen  register  or  trap  & trace  orders  are 
authorized  under  section  3125(a)  only  when  there  exists  an  immediate  danger  of  d eath  or  serious 
odily  injury  to  any  person,  or  where  there  are  conspiratorial  activities  characteristic  of 
organized  crime.  And  this  bill  will  add  two  other  emergency  circumstances  to  bring  the  pen 
register  statute  in  relative  parallel  with  the  wiretap  emergency  provisions  and  to  acknowledge 

mat  attacks  on  certain  government  or  public  computer  infrastructure  could  seriously  endanger 
the  public  health  or  safety.  3 * 

Even  in  emergency  situation,  a court  order  ratifying  the  use  of  the  pen  regi  ster  or  trap  & 
trace  must  be  sought  and  obtained  within  48  hours.  Since  the  current  statute  authorizes  the 

m r^Ster  2t  *"  SMe  leVel  by  **  Coiint>’ District  Attorney,  it  has 
been  argued  that  the  current  restncttons  on  emergency  deployment  by  Federal  authorities  are  bv 

comparison,  incongruous,  unnecessarily  restrictive,  cumbersome  and  time  consuming.  Based  ' 
upon  law  enforcement’s  experience,  the  problem  is  especially  acute  in  dynamic  computer 
investigations  where  time  is  frequently  of  the  essence.  The  proposed  amendment  would  in 
addition  to  the  class  of  DOJ  officials  currently  authorized  to  issue  emergency  pen  registers  or 
implement  trap  & trace,  statutorily  authorized  the  issuance  of  emergency  implementation  upon 
the  request  of  either  a "Uatet  States  Attorney  or  te^pal  sup^s^e  iL  enfor^ 


officer  Si'  Umted  bt3teS  Attoraey  or  the  PnnctP**  supervising  law  enforcement 

vests  “ PeaLnfster  ortraP  and  trace  5f»  an  emergency  situation 

JJ  a«ffionfy  with  the  official  who  is  m the  best  position  to  assess  the  need  and  propriety  of  use 

en  e passing  of  mere  minutes  may  mean  the  loss  of  valuable  information,  for  example  in  an 

roSS  f?Uter  attack'  At  the  S3me  tkne’ t&  esPfess  designation  will  continue  to  assure  the 
nsistent  administration  of  law  enforcement  policy  on  the  use  of  pen  registers  and  trap  and 

trace  devices  by  retaining  centralized  responsibility  for  approving  emergency  use  in  a limited 
number  ot  identifiable  and  politically  accountable  officials.9 


S.  Rep.  Mo.  1097  90th  Cong.  2dSes$.  (19 6$), reprint J in  196SU.S.C.CAN  "MP  ’185  ( amroval 
level  tor  wiretap  applications).  • J - P?TO  *>‘ 
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Expediting  Emergency  Pen  Register  and  Trap  & Trace  Implementation 
(Exclusive  of  any  other  Amendments) 

Section  3 1 25.  Emergency  pen  register  and  trap  and  trace  device  installation 

(^Notwithsmding  any  other  provision  of  this  chapter, -any  investigative  or  law  onforccmuu 
otficcr,  3pcci%  de3igMted  by  the  Attorney  General,  the  Deputy  Attorney  General,  the 


9 •■■Si  8KS»  SilS 

prcfcutins  att°mey  of  any  State  or  subdivision  thereof  amine  pmS  to  ^statute  of 
tnat  state,  who  reasonably  determines  that— 
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MATTER  NOT  CONTAINED 
IN  BILLS  CURRENTLY  UNDER  CONSIDERATION 


5 Title  IH  Wiretap  Exception  for  the  Interception  of  Unauthorized  Computer  Trespassers 
Only  upon  the  Written  Request  of  the  Owner/operator  of  the  Computer  Syst  em. 


5/2 4/62  Reteas*  * Page  35] 


(Irrespective  of  other  Amendments) 


[18U.S.C.  §2511] 


'fansmiuvs  to  or  from  jj  co*puti  trcsp||p  ** 


[18  US.C.  §2510] 

2Slfi5rtS^^&ed  t0‘ togh>  °r  fr°m  3 pf0teaed  computer  becau^rach^Sn  is' 
accessing  the^stected  computer  without  authorization,  ^ * " 


mm? 
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Bowsed  Legisutiw  b,„ 

Tn  E Bctor''  n*  Computer  tr™*. 

^SPASSm^^xctnim 
private  electrTend,nerit  ^°WS’  bW  d°eS  not  squire  owners  and 

; te  eie^tr°njc  or  wire  communication  service  . ^^^orsof^erpu^  or 

^mmunications/tran,m-  • 68  £o  mho™  law  enW* 
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Attn:  Deputy  Director's  Office 

Mr.  Pickard 
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Drafted  By: 

Case  ID  # : 62C-HQ- 1077728 


Title:  ACTION  MEMORANDUM : 

HOUSE  JUDICIARY  COMMITTEE; 

CONSTITUTION  SUBCOMMITTEE; 

HEARING  ON  "FOURTH  AMENDMENT  ISSUES  RAISED  BY  THE  FBI'S 
1 CARNIVORE ' PROGRAM " 

07/24/2000 

Synopsis:  The  Constitution  Subcommittee  of  the  will  conduct  a 

hearing  on  Monday,  07/24/2000,  at  1:00  PM,  in  Room  2141  of  the 
Rayburn  House  Office  Building.  The  purpose  of  the  hearing  is  to 
examine  "Fourth  Amendment  issues  raised  by  the  FBI's  'Carnivore' 
program."  Consequently,  the  Subcommittee  has  requested  that 
Laboratory  Division  Director  Dr.  Donald  M.  Kerr  and  General 
Counsel  Larry  R.  Parkinson  appear  on  behalf  of  the  FBI. 

Details:  The  Constitution  Subcommittee  will  conduct  a hearing  to 

examine  Fourth  Amendment  issues  raised  by  "Carnivore."  The 
Subcommittee  has  preliminarily  advised  that  the  hearing  will  be 
composed  of  two  panels.  The  first  panel  will  have  witnesses  from 
the  U.S.  Department  of  Justice  (DOJ) , to  include  the  FBI.  The 
second  panel  will  be  composed  of  individuals  from  private 
industry  and  Internet  privacy  groups.  It  is  anticipated  that 
Deputy  Assistant  Attorney  General  Kevin  DiGregory , as  well  as 
David  Green  from  CCIPS,  will  represent  the  Department.  The 
specific  private  sector  witnesses  have  not  yet  been  determined. 
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To:  Director’s  Office  From:  Director's  0££&^  Office 

of  Public  and  Congressional  Affairs 
Re:  62C-HQ- 1077728,  07/17/2000 


The  Subcommittee  has  requested  that  the  Laboratory 
Division  and  the  Office  of  the  General  Counsel  provide  a written 
statement  for  the.  official  record  which  the  witnesses  may 
summarize  for  the  Subcommittee.  The  written  statement  must  also 
be  provided  to  the  Subcommittee  on  a computer  disk  or  through 
email.  These  items  must  be  provided  to  the  Subcommittee  no  later 
than  Friday,  07/21/2000.  A letter  of  invitation  from  the 
Subcommittee  has  not  yet  been  received. 

LEAD (s)  : 

Set  Lead  1: 

PI RECTOR  1 S OFF I CE 


AT  WASHINGTON,  PC 

It  is  requested  that  the  Deputy  Director  approve  Dr'. 
Kerr  and  Mr.  Parkinson's  participation  as  witnesses  at  captioned 
hearing . 

APPROVE  

DISAPPROVE  

SEE  ME  


Set  Lead  2 : 

LABORATORY 


AT  WASHINGTON-  DC 


It  is  requested  that  the  Laboratory  Division  prepare 
testimony,  with  assistance  from  th^Of^m^o^^eneral  Counsel, 
for  Dr.  Keo^md  provide  it  to  SSA KoomHHl  J>7C 
Extension vHK  &y  COB  07/19/2000,  ^^^e^that^t  may  be 
transmitted  to  PQJ  for  clearance  and  then  to  the  Subcommittee  in 
a timely  fashion. 


7 

-/ 


2 
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To:  Director's  OfsUce  From:  Director's  Of f L ■,&  Office 

of  Public  and  Congressional  Affairs 
Re:  62C-HQ- 1077728,  07/17/2000 


Set  Lead  3 : 


GENERAL  COUNSEL 

AT  WASHINGTON , DC 

It  is  requested  that  the  Office  of  General  Counsel 
assist  the  Laboratory  Division,  as  needed,  in  the  preparation  of 
testimony  for  captioned  hearing. 


Set  Lead  4s 


OFFICE  OF  PUBLIC  AND  CONGRESSIONAL  AFFAIRS , 
CONGRESSIONAL  AFFAIRS  OFFICE 


AT  WASHINGTON.  DC 


The  Congressional  Affairs  Office  will 
appearances  of  Dr.  Kerr  and  Mr.  Parkinson  before 


coordinate 

the 


the 


Subcommittee;  the  approval  of  the  testimony  from  the  Deputy 
Director's  Office;  and  the  voting  of  the  testimony  by  DOJ. 


♦♦ 
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; INTERCEPTION  OF  E-MAIL 

White  House  Tries  to  Balance 
• Rights  of  Computer  Users* 
and  Law  Enforcement 

By  STEPHEN  LAB  ATOM 
with  MATT  RICHTEL 

WASHINGTON,  July  17  - The 
White  House  said  ted  ay  that  it  would 
propose  legislation  to  set  legal  re- 
quirements for  surveillance  in  cy- 
berspace by  law  enforetmerH  au- 
thorities similar  in  some  ways  to 
those  for  telephone  wiretaps. 

Privacy  advocates  and  civil  liber- 
tres  groups  welcomed  some  aspects 
of  the  proposal  but  said  they  re- 
mained alarmed  about  a new  RBI 
computer  system  that  searches  and 
intercepts  private  e-mail  and  can 
easily  capture  communications  of 
people  not  suspected  of  crimes. 

The  legislative  proposal  w as  made 
as  the  administration  also  an- 
nounced today  that  it  had  eased  ex- 
port controls  o n encryption  technol- 
ogy, making  ii  significantly  easier 
lor  American  companies  to  sell  soft- 
ware products  to  the  European 
Union  and  eight  other  trading  pan- 
nets  that  cart  be  used  to  keep  com- 
puter data  and  communications  se- 
cure. 

Both  the  electronic  surveillance 
proposal  and  the  export  control 
changes  are  part  of  a broader  policy 
outlined  in  a speech  today  by  John  D, 
Podesta,  the  White  House  chief  of 
staff.  He  said  the  policy  tries  to  bal- 
ance the  privacy  rights  of  computer 
M$ers  against  the  needs  of  law  en- 
forcement to  be  able  to  monitor  digi- 
tal communications. 

Congress  and  federal  regulators 
have  done  little  work  in  the  area, 
even  as  the  world  has  quickly  come 
to  rely  heavily  on  commtinicaiions 
through  cyberspace-  More  than  1.4 
billion  e-mail  messages  change 
hands  every  day. 


The  administration's  legislative 
proposal  on  electronic  surveillance 
tries  to  fix  the  inconsistent  patch- 
work  of  laws  that  apply  different 
standards  to  telephone,  cable  and 
other  technologies  with  a single 
standard  for  those  systems  and  the 
Internet  Prospects  for  the  proposal 
in  Congress  are  uncertain. 

Until  now,  law  enforcement  agen- 
cies have  been  able  to  monitor  elec- 
tronic communication  with  only 
modest  court  supervision. 

The  proposed  legislation  would  re- 
quire that  the  same  standards  that 
apply  to  the  interception  of  the  con- 
tent of  telephone  calls  apply  to  the 
interception  of  e-jnad  messages.  Spe- 
cifically, it  would  retire  law  en- 
forcement agents  to  demonstrate 
that  they  have  probable  cause  of  a 
crime  to  obtain  a court  order  seeking 
the  contents  of  a suspect's  e-mail 
messages. 

The  proposal  would  also  give  fed- 
eral magistrates  greater  authority  to 
review  requests  by  law  enforcement 


authorises  for  so-called  pen  regis- 
ters — lists  of  the  phone  numbers 
called  from  a particular  location  and 
the  time  of  the  calls.  The  magistrates 
now  ha  ve  no  authority  to  question  the 
request  for  such  lists,  which  are  fre- 
quently used  by  die  authorities, 
v in  the  context  of  the  Internet,  ex- 
isting laws  are  ambiguous  about 
what  standards  apply  tor  different 
kinds  of  surveillance.  Many  limita- 
tions imposed  on  law  enforcement  in 
the  context  of  telephone  wiretaps  — 
like  the  requirement  that  such  taps 
be  approved  at  the  highest  level  of 
the  Justice  Department  — do  not 
appear  to  apply  to  e-mail  surveil- 
lance 

Moreover,  the  Cable  Act  of  ISS4 
sets  a far  harder  burden  for  govern- 
ment agents  to  satisfy  when  trying  to 
monitor  computers  using  cable  mo- 
dems than  when  monitoring  tele- 
phones  That  has  proved  trouble- 
some for  law  enforcement  author!* 
ties  as  more  Americans  begin  to  use 
high-speed  Internet  service  through 
cable  networks.  The  Cable  Act  also 
requires  that  the  target  of  the  sur- 
veillance be  given  notice  and  m op- 


Concern  that  the 
proposals  allow 
federal  agents  too 
much  leeway. 


ponunity  to  challenge  the  request. 


*Tt's  time  to  update  md  harmo- 
nize our  existing  law's  to  give  all 
forms  of  technology  the  same  legis- 
lative protections  as  our  telephone 
conversations/'  Mr,  Fodesta  said  in 
a speech  at  the  National  Press  Club. 
"Our  proposed  legislation  would  bar* 
momie  the  legal  standards  that  ap- 
ply to  law  enforcement's  access  to  e- 
mails,  telephone  calls  and  cable 
serviCfis." 

Wite  House  officials  said  today 
that  they  hoped  the  proposal  would 
break  a logjam  in  Congress  where  a 
variety  of  different  measures  have 
been  introduced  dealing  with  elec- 
tronic surveillance.  The  administra- 
tion's proposal  adopts  seme  ele- 
ments of  both  Democratic  and  Re- 
publican bills. 

But  Congressional  aides  said  there 
was  too  little  time  left  in  the  legisla- 
tive session  and  that  the  matter 
would  in  all  likelihood  remain  unre- 
solved until  after  the  next  term  be- 
gins, in  2003  . 

Administration  officials  said  the 
proposal  would  apply  io  communica- 
tions that  either  begin  or  end  in  the 
United  Slates.  It  would  not  apply  toe- 
mail  messages  transmitted  entirely 

outside  the  country. 

Privacy  and  civil  liberties  groups 
criticized  the  administration's  pro- 
posal because  it  would  continue  to 
v perm  it  the  government  to  use  a new 
surveillance  system  that  the  groups 
say  may  be  used  far  more  broadly 
than  older  technologies,  enabling  fed- 
eral agents  to  monitor  an  unlimited 
amount  of  innocent  communications* 
including  those  of  people  who  are  not 
targets  ef  criminal  investigations. 

The  system,  used  by  the  Federal 
Bureau  of  Investigation,  is  called 
Carnivore,  so  named,  agents  say,  be- 
cause h is  able  to  quickly  get  the 
“meat"  in  huge  quantities  of  e-maii 
messages,  so-called  instant  messag- 
ing and  other  communications  be* 
tween  computers. 

Carnivore  is  housed  in  a small 
black  box  and  consists  of  hardware 
and  software  that  trolls  for  informs* 
tiem  after  being  connected  to  the  net- 
work of  an  Internet  service  provider. 
Once  Installed,  it  has  the  ability  to 
monitor  ail  of  the  e-mail  on  a net- 
work, from  the  list  of  what  mail  is 
sent  to  the  actual  contain  of  the  com- 
munications. 
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Marcos  C.  Thomas,  secu^Lhief  of 
the  Cyber  Technology  Section  of  the 
F.B.L,  said  the  technology  was  devel-  . 
oped  U months  ago  by  F.B.l  engi- 
neers and  has  been  used  fewer  than 
25  times.  Mr,  Thomas  said  that  Car- 
nivore had  potentially  broad  capahil- 
hies  and  that  he  understood  the  con- 
cerns of  privacy  groups. 

“It  can  do  a ton  of  things/'  he  said, 
"‘That's  why  it’s  illegal  to  do  so  with- 
out a clear  order  f rom  the  court/* 

He  said  that  mm  Internet  service 
providers  had  cooperated  with  re- 
quests to  use  Carnivore. 

Privacy  groups  and  some  Internet 
sendee  providers  have  been  deeply 
critical  of  the  use  of  Carnivore  be- 
cause,  once  Installed  on  a network,  it 
permits  the  government  to  take 
whatever  information  it  wants. 
Moreover,  the  government  has  not 
said  what  it  does  with  the  extraneous 
material  iV  gathers  that  is  not  rele- 
vant  to  the  particular  surveillance,  “ 
The  issue  does  not  often  arise  to- 
day with  the  monitoring  of  telephone 
conversations  because  when  a law  j 
enforcement  authority  wants  to  see  a 
tost  of  telephone  calls  made  by  a 
suspect,  the  agent  gets  an  order  from 
a magistrate,  presents  the  order  to  a 
telephone  company,  and  the  compa- 
ny then  turns  over  the  list. 

In  at  least  one  instance,  an  Inter-  j 
net  company  did  not  cooperate  so 
readily  with  the  government.  In  De- 
cember, federal  marshals  ap*  j 
preached  the  company  with  a court  j 
order  permitting  them  to  deploy  a j 
device  to  register  time,  date  and  l 
source  information  involving  e-mail 
messages  sent  to  and  from  a speci- 
fied account. 


Trying  to  establish  a 
single  standard  for 
different 
technologies. 


Concerned  the  device  would 
record  broader  information,  the 
company  countered  with  a compro- 
mise: ft  would  provide  the  govern- 
ment with  the  requested  information 
about  e-mail  senders  and  recipients, 
according  to  Robert  Corn -Revere,  a 
lawyer  for  the  company,  in  recent 
Congressional  testimony.  The  com- 
pany was  later  identified  as  Earth- 
Link,  a service  provider  with  15  mil-  , 
lion  subscribers. 

Mr.  Corn-Re  vere  said  the  govern- 
ment initially  accepted  the  compro- 
mise but  later  became  dissatisfied 
and  wished  to  use  its  own  device, 
EanhLmk  objected  but  was  over- 
ruled by  a a federal  court,  which 
ordered  the  de  vice  deployed. 

Other  Internet  companies  have 
also  been  critical  of  Carnivore. 


William  Lv  Schrader,  chairm/  % 
and  chief  executive  of  PSINet*  a i £^/ 
jor  commercial  Internet  service  pro- 
vider, said  that  the  system  gave  the 
F,BX  the  ability  to  monitor  e-mail 
messages  of  every  person  on  a given 
network.  He  said  he  would  refuse  to 
permit  the  government  to  use  the 
technology  at  PSINet  unless  2 gems 
could  prove  that  it  could  only  sift  out 
the  traffic  from  a given  individual 
that  is  the  target  of  a court  order. 

'■|  object  to  American  ci tiaern  and 
any  citizens  of  the  world  always  be- 
ing subject  to  someone  monitoring 
their  e-mail/*  said  Mr.  Schrader, 
whose  company  serves  about  100,000 
businesses  and  more  than  10  million 
users.  *1  believe  irstmconstrtutlonal 
and  HI  wait  for  the  Supreme  Court  to 
force  me  to  do  it/* 

Civil  liberties  groups,  meanwhile, 
said  that  today's  policy  announce- 


mem  was  an  inadequate  response  to 
the  growing  controversy  over  the 
deployment  of  Carnivore. 

“Today’s  speech  was  camouflage 
to  cover  the  mess  that  i$  Carnivore/' 
said  Barry  Steinhardi,  an  associate 
director  of  the  American  Civil  Liber- 
ties  Union.  “In  light  of  the  public  and 
Congressional  criticism  of  Carni- 
vore, we  had  hoped  and  expected  far 
more  from  an  administration  that 
likes  to  tout  its  sensitivity  to  privacy 
rights.  Rather  than  glossing  over 
Carnivore,  Fodesta  should  have  an- 
nounced that  the  administration  w as 
suspending  its  use." 

Facing  growing  concerns  about 
Carnivore,  Attorney  General  Janet 
Reno  said  on  Thursday  that  she 
would  review'  whether  the  system 
was  being  used  in  a manner  consis- 
tent with  privacy  rights  in  the  Consti- 
tution and  in  federal  law*,  a subcom- 
mittee of  the  House  is  set  to  hold  a 
hearing  next  week  on  the  system. 

While  the  civil  liberties  and  pri- 
vacy groups  applauded  giving  judges 
greater  discretion  to  review'  certain 
kinds  of  requests  for  surveillance, 
they  were  critical  of  other  aspects  of 
the  proposal. 

Marc  Roienberg,  director  of  the 
Electronic  Privacy  Information  Cen- 
ter, a research  organization  that 
studies  privacy  issues  and  technol- 
ogy, criticized  the  administration  for 
lowering  the  standards  for  surveil- 
lance of  cable  modems  rather  than 
raising  the  standards  for  telephone 
surveillance. 

“The  Cable  Act  provides  for  one  of 
the  best  privacy  protections  in  the 
United  States/*  Mr,  Rotenberg  said, 
“The  question  is  whether  to  harmo- 
nize up  or  harmonize  down.  Our  view 
is  this  harmonizes  down/* 

But  administration  officials  said 
the  Cable  Act  never  contemplated 
that  there  would  be  broad  use  of 
cable  modems  for  e-mail  traffic  and 
that  the  standards  used  for  obtaining 
warrants  for  telephone  surveillance 
should  also  apply  to  digital  commu- 
nications through  cable  networks. 


1 

1 
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The  Clinton  administration  yes-  * 
torday  called  for  updating  wiretap- 
ping Jaws  to  extend  the  powers  of 
law  enforcement  to  the  online  world 
while  providing  new  legal  protec- 
tions for  electronic  eommtirueaf  ion. 
Administration  officials  also  an- 
nounced, asexpecteiaplan  tolooS' 
en  con  trols  on  the  export  of  enejyp-  . 
tioit  software — the  programs  that 
help  Internet  users  scramble  mes- 
sages and  data  to  protea  them  from 
PWjgeyes. 

On  the  wiretapping  issue.  White 
House  chief  of  staff  John  D.  Pode- 
sta,  in  3 speech  at  the  National  Press 
Club,  described  the  coming  legisla- 
tive package  as  seeking  to  eliminate 
confusion  about  the  level  of  legal 
protection  for  various  forms  of  com- 
munication. 

Telephone  conversations  get  fair* 
ly  strong  protection  from  federal 
wiretaps  under  the  1966  Crime  Pa- 
trol and  Safe  Streets  Act,  which  re- 
quired s court  order  and  high-level 
Justice  Department  approval  Wire- 
tape  rules  for  e'tftail  sent  by  dial-up 
modem  are  covered  by  the  Electron- 
ic Communications  Privacy  Act  of 
I9S6,  That  law  might  not  cover  e- 
rmil  sent  by  high-speed  cable  mo- 
dem, and  cable  companies  have  ar- 
gued that  their  online  sendees 
should  bet  given  extremely  high  pro 

teoion  fro m government  surveD- 
iance  under  the  Cable  Act. 

*1fs  time  to  update  and  harmo- 
nic our  existing  laws  to  give  all 
forms  of  tedxnolog}1  the  same  legis- 
lative protections  as  our  telephone 
conversations,"  Podesta  said. 

Lawmakers  said  they  welcome 
the  opport  unity  to  work  with  t he  ad- 
ministration  on  these  issues.  Sen, 

Omit  G.  Hatch  (R-U&hh  who  has 
introduced  an  internet  pricey  bill, 
said:  ‘It  is  imperative  that  we  bal- 
ance the  interests  of  law  enforce- 
ment with  the  privsqr  rights  of  the 


American  people,  We  must  ensure  that  appropriate 
checks  are  in  place  where  the  government  accesses  pri- 
vate eommmu  cations  of  Americans* 

Pod esu  said  the  bills  making  up  the  passage  wouldbe 
tmveSed  within  10  and  that  he  hopes  the  legisla- 
tion can  be  passed  by  the  end  of  theyear, 

Pbdesta  also  spoke  about  the  new  surveillance  teefe- 
ttology  known  as  Carnivore,  which  gives  law  enforce- 
ment authorities  the  ability  to  selectively  monitor  the 
' Internet  traffic  of  mdbiduab.  mmhr  to  the  devices  that 
can  record  the  telephone  numbers  of  calls  made  and  re- 
cemd  by*  suspect  Unlike  full-fledged  wiretaps,  the  jte 
, didal  oversight  of  such  surveillance  1$  slight,  and  the 
protection  against  abuses  of  the  technology  by  kw  en- 
forcement is  vreajc  Fodesta  called  for  greater  judicial 
oversight- 

The  Fodesta  speech  was  not  well  received  by  rivS  Hh- 
erb'c^  advocates,  who  have  fought  Carnivore  and  other 
admixustratlon  at  tempts  to  expand  wir  etapping  capabO- 
ities  on  the  Internet  Barry  SteiaJwdt,  associate  direc- 
tor  of  the  American  Civil  Liberties  Union,  called  the 
speech  ‘deeply  disappomttog, , , While  the  Clinton  ad- 


nMftsiratJon  s proposals  have  some  heartening  qualit h 
to  fhenuhey  are  too  little  and  too  late,*  with  too  m 
tune  m ihe  legislative  session  to  pass  new'  bills  The  Ca 
to  system,  Steinhank  said,  *r«pres«tts  a m, 
threat  to  the  privacy  of  all  Americans  by  giving  law  er 
forcemeat  agencies  unsuo^mV-ri  „ **** 


T ^ ^topantes  win  be  me  to  export  s 

pmsucaled  cryptography  products  to  users  b.  any  n 

.krfrT1! Ujiion  b>  Australia,  Nom* 
the X2eeh  Republic,  Bcng^v  Poland,  Japan,  New  Z& 
land  and  bwit^rknd.  The  government  w3I  diminat 
the  statutory  3&day  waiting  period  before  such  export 
enn  take  place  but  will  keep  m place  a requirement  ths 

I"?  submitted  to  the  government  for 

techmcd  reviews 

Encr>-ption  has  heea  a high-tech  batUeSeid  from  th 
early  daw  of  the  Ctoton  admimsfratism.  Few  tedxaotc 
«*? 5*. 25  in  the  fight  to  maintain  persora 

anti  OEJ<tJn+*CQ  ^ < >■.  r 


Tt  . , tr  **w- ^oraanent  omoals  like  FBI I 
rector  Louis  X Freeh,  who  often  wants  that  crimina 
and  tmomts  can  use  ‘crypto"  to  cloak  their  plans  ar 
^.tonkes.  High-tech  companies  successful}*  argued  th 
restrictions  harmed  only  American  comnanie 


encryption  products,  and  in  January  thedmton  admin 
istrakon  reduced  controls  on  encryption  exports. 

The  reducing  of  these  regulations  wiE  certainly  ah 
pw  u,S.  sofu-axe  makers  to  compete  m the  global  mar, 
ketpbce."  s aid  Robert  HoOeynan,  the  chi^ oeccuti^f 
toe  Business  Software  Aliianae, 


Fr&tn  Associated  Press 


^ White  Heus< 

proposed  leglsiatson  Monday  to  update 
wiretapping  rules  so  that  feral  nrotecr 
isom  currently  applied  to  telephone  calls 
are  extended  to  electronic  communica' 
bom  such  as  e-mail 

wouW-rKJ^re  law  enforce- 
“ o..iaafs  to  obtain  high-level  ap- 
proval before  applying  for  a court  order 
to  intercept  the  content  of  e-tnail-in  fine 

ropLTcansWteth3\fiOVeroi,Sts^ 

B&sicsily,  the  same  communicate  if 
difkrent  w3,y  ^through  a phone 
cay  or  a dial-up  modem— is  subject  to  dtf- 
ierent  and  inconsistent  privacy  stand- 

‘ ^ ^ouse  Chief  of  Staff 

John  Fofeu,  in  announcing  the  propot- 

***  >,]t  - «*«»  «>  update  &nd  harmonize 
our  existing  lews  to  give  all  forms  of  tech- 
noior?  the  same  legislative  protectee  a « 
our  telephone  con  versations,^ 

The  wiretap  proposal  also  addresses  so- 
caded  "trap  and  trace"'  orders,  which  ah 
lsw  te  enforcement  officials  to  identify 
the  source  of  a phone  call  or  an  e-mail 
but  not  Its  content.  Under  the  proposal 
kw  enforcement  officials  would  onlv 
need  one  order-even  to  trace  an  e-mail 
or  a phone  call  that  may  travel  through 
multiple  phone  carriers  or  Internet  pro- 
viders, ' 


Officials  also  could  trace  such  commu- 
nications without  prior  approval  in  an 


emergency  situation,  such  as  when  a 
computer  is  under  attack. 

But  for  the  first  time,  the  administra- 
te ts  proposing  that  a federal  or  state 
judge  independently  determine  whether 
the  facts  support  such  a trace  order.  ' 

Officials  were  asked  how  those  changes 
would  impact  the  new  "Carnivore"  sys- 
tem, which  the  FBI  is  using  to  obtain V 
mails  of  investigative  subjects  with  a 
search  warrant  When  Carnivore  is 
piaced  at  an  Internet  service  provider,  it 
scans  all  incoming  and  outgoing  e-mails 
for  messages  associated  with  the  target  of 
a criminal  probe. 

If  the  Carnivore  system,  is  being  used 
to  intercept  the  content  of  electronic 
communications,  then  law  enforcement 

officials  would  need  high-level  Justice 
Department  approval  before  obtaining  a 
court  order  and  stricter  standards  limit- 
ing  m use  would  apply,  Podesta  said. 

The  FBI  says  the  tool  already  is  $uh~ 

to  intense  oversight  from  ni  own  in- 
ternal controls,  the  Justice  Department 
and  the  courts-with  signification  penal- 
ty for  misuse  of  the  system. 

The  proposed  measures  also  would  ad- 
dress inconsistencies  in^how  current  law' 
applies  to  different  networks  carrying  In- 
ternet traffic.  For  example,  now'  that  ca- 
ble systems  are  being  upgraded  to  offer 
two-way  services,  laws  that  apply  to  dial- 
up  modems  over  phone  lines  should  be 
extended  to  cable  connections.  Podesu 
said. 
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on  Encryption 
Software  Exports 

ASHLEY  DUNN 

and  CHARLES  WU» 

Tints  st*H  wsims 

The  Clinton  administration  on  Mon- 
day further  eased  the  remaining  re- 
strictions on  setting  high-powered  en- 
cryption products  overseas,  clearing 
the  way  for  American  firms  to  export 
to  the  European  Union  and  several 
other  key  trading  partners* 

The  new  policy  drops  a requirement 
that  U.S,  companies  get  a special  IV 
* cense  to  sell  encryption  products— a 
process  that  previously  Involved  a 
technical  review  or  a 30-day  delay  . 

In  addition,  the  rales  allow  compa- 
nies to  sell  their  products  to  not  only 
businesses  and  consumers,  but  also 
government  agencies,  which  used  to 
require  a special  license. 

The  rules  apply  to  encryption  ex- 
ports to  the  15  nations  of  the  European 
Union,  as  well  as  Australia,  Norway. 
Czech  Republic,  Hungary,  Poland,  Ja- 
pan. New  Zealand  and  Switzerland, 
The  new  rules  follow  the  adminis- 
trail's  major  turnaround  in  Jam*, 
**>*'  it  finally  opened  the  way 
for  companies  to  export  the  hardest- 
tocrack  scrambling  technology. 

American  technology  companies 
and  pri  vacy  advocates  had  fought  for 
years  for  permission  to  export  its  erv- 
ciyption  technology  abroad 
The  industry  argued  that  the 
spread  of  strong  encryption  would 
fuel  electronic  commerce  and  reas- 
^ire  consumers  that  their  credit  card 
numbers  and  other  private  communi- 
cations would  not  bo  compromised. 

Wltite  House  Chief  of  Staff  John 
Podesu,  speaking  at  the  National 
Press  Club,  described  the  changes 
announced  on"  Monday  as  pan  of  an 
ongoing  effort  to  update  VS.  policy* 

"The  Internet,  like  Morse's  tele- 
graph, brings  with  it  new  possihih 
h*  said.  "It  also  brings  new 
challenges  lo  our  most  fundamental 
values  and  the  need  for  new  lawis  and 
new  protections  to  maintain  them." 
Industry  and  security  experts  wel- 


comed the  latest  anno uncement  as 
another  sign  of  the  federal  govern- 
ment’s new-found  support  of  liberal- 
izing encryption  exports. 

1 "It  s obviously  very  important  if 
ILS.  software  companies  are  going  to 
compete  in  the  global  market/’  said 
Ami?  Vomit  a former  department  of 
Defense  security  official  and  presi- 
dent of  RipTeeh,  a security  company 
m Alexandria,  Va. 

According  to  Scott  Schnett,  senior 
vice  president  of  RSA  Data  Security, 
a top  encryption  software  producer, 
the  new  rules  are  important  because 
they  remove  restrictions  to  selling  to 
national  governments. 

Governments  are  often  the  biggest 
buyers  of  security  software,  particu- 
larly in  the  recently  democratized  na- 
tions of  Eastern  Europe  . 

"Both  the  relaxation  and  mmalk 
nation  around  government  use  of  the 
technology  is  a realisation  of  the  core  - 
importance  of  the  security  over  the 
Internet,*  Schnell  said,  'This  is  a tre- 
mendous boost  for  the  US.  software 
industry" 

But  others  said  that  until  the  regu- 
lations can  be  thoroughly  reviewed 
by  legal  experts,  their  impact  would 
be  uncertain. 

The  devil  in  this  case  is  in  the  de> 

tsus.  said  Jeff  Schiller,  a iiiading  se- 
curiiy  expert  and  netw  ork  manager 
for  M^sachuseUs  Institute  of  Tech- 
nology. Law  enforcement  and  safety 
concerns  remain,  he  said.  "How  are 
those  addressed?  I'd  be  very-  sur- 
prised if  they  were  just  lifting  the 
controls." 

He  said  that  he  suspects  hidden  re- 
strictions could  still  bar  the  export  of 
soon  products  to  the  wrong  coyn- 
toes. 

Let's  &ay  someone  in  one  of  the 
forbidden  countries  gets  an  30 
coum  on  America  Online,"  Schiller 
said.  "When  they  use  their  Web 
browser  to  get  m the  Net,  it’s  go- 
ing to  say  Virginia  [where  many 
AOL  server  computers  that  route 
Internet  traffic  are  located].  I don't 
know  they  are  from  Libya,  Under 
those  circumstances  who  is  respon- 
sible? Am  I responsible?  k AOL  re- 
sponsible?" 

But  Schiller  said  that  any  relaxa- 
tion of  export  controls  is  an  ac- 
knowledgment of  reality, 

“You  cannot  turn  the  tide  of 
technology  back,”  he  said.  "The 
bad  guys  are  going  to  do  what  they 
will  do/’  while  legitimate  users  of 
encryption  products  are  harmed  by 
export  controls. 
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Rules  on  encryption 
exports  are  relaxed 

The  United  States  has  eased  its  rules  on  exporting 
encryption  products  to  the  European  Union  and  other 
key  trading  partners 
m an  eflbrt  to  improve 
security  in  cyberspace 
^promote  demon- 
ic commerce,  the 
White  House  said 
Monday  j 

US,  companies  no 
longer  need  an  export 
license  to  sell  eneryp- 
tion  products  to  users 
in  the  key  trading 
countries,  the  White 
House  said,  i 

The  policy  allows 
US.  exporters  to  ship  : 
their  products  without 
waiting  for  a technical 
re^ew  0f  3 

Podesta:  Change  should  not  delay  as  they  have  In  j: 
threaten  US,  security  the  past.  Businesses 
< , ..  . , snd  privacy  advocates 

had  said  that  US.  export  rules  were  too  restrictive,  but 
law  enforcement  oSdab  said  sophisticated  encryp- 
tion aids  international  criminal  enterprises  and  terro- 
rists, White  House  Chief  of  Staff  John  Podesta  said  the 
changes  should  prov  ide  adequate  sexoihry  : 

The  White  House  also  proposed  legislation  to  up- 
date wiretapping  rules  so  that  protections  currently 
applied  to  telephone  calls  are  extended  to  electronic 
communications  such  as  e-mail.  The  changes  could  af- 
fect the  system  the  FBI  uses  to  access  the  e-mails  of 
criminal  suspects,  investigators  would  have  to  obtain 
high-level  approval  before  seeking  a court  order. 
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House  Rejects 
Bill  Limiting 
Web  Gambling 

Parties  Sharply  Divided; 
White  House  Opposed 


By  Dam  Mobcak 
and  John  ScHw^n 
3 T&skwgim  B uss  Staff  S teers 

The  House  last  night  defeated  a hill  that 
would  have  barbed  most  forms  d online  gam- 
bling, fegiriatlon  intended  to  curb  the  explo- 
sive growth  of  casino-style  wagering  on  the 
World  Wide  Web. 

1ft  a vote  that  rejected  sharp  divisions 
within  both  major  parties  over  the  issue,  44 
Republicans  joined  114  Demccrats  and  one 
independent  to  defeat  the  measure.  Under  a 
procedure  to  bring  the  bill  to  the  floor  with' 
mi  amendments,  a two-thirds  vote  of  those 
present  u^as  required  to  pass  the  legislation. 
The  final  vdty  of  245  to  159  fell  25  votes  short 
of  the  270  needed. 

The  feOI  drew  opposition  from  lawmakers 
and  advocates  concerned  shout  federal  reg- 
ulation of  Internet  contend  as  wet!  as  the  po- 
tential for  invasion  of  privacy.  Critics  also 
raised  concerns  that  to  make  the  legislation 
palatable  to  the  pobfrcaOy  influential  pm- 
mutud  horse  racing  and  dog  racing  in- 
dustries. GOP  leaders  had  agreed  In  exempt 
lions  that  would  actually  legalise  an 
expansion  of  opportunities  lor  online  gam- 
bling; 

The  bill  was  intended  to  address  growing 
fears  among  lawmakers  about  the  explosive 
growth  of  unregulated  online  sites  where  in- 
dividuals can  engage  in  card  games 
and  other  casincHtyk  gambling  on 
their  computers.  More  than  700  such 
sites,  many  of  them  nut  out  of  foreign 
countries  or  offshore  havens,  are  now 
operating  without  regulation,  with 
raugidv  $12  billion  wagered  annu- 
ally. 

Under  ih$  bill  defeated  yesterday, 
stale  law  enforcement  agendes 
would  have  been  able  to  go  io  court 
to  obtain  orders  requiring  Internet 
service  providers  to  block  access  to 
Web  sites  that  engaged  m Illegal  gam- 
bling 

Bef  ore  last  night's  vote  ( Rep.  Rob- 
ert W.  GoodJsite  {R-Va,},  chief  Spon- 
sor of  the  bill,  cited  a bun}1  of  serial 
ilis  linked  to  gambling-~crime,  bank- 
ruptcy. addiction  and  more— and 
said  that  Internet  gambling  will  bring 
drirens  the  same  problems  *as  you 
would  have  If  you  had  a casino  in  your 
home  town.4* 


But  the  White  House  it 
*mm$f  opposed  the  bill  and 
stressed  in  particular  its  objections  to 
the  exemptions  that  would  aBmv  the 
parimumd  industry  to  conduct  on- 
Hne  betting  under  cootroSed  condi- 
tions. 

Although  the  Senate  has  passed  a 
similar  hi,  it  appeared  unlikely  kst 
night  that  the  GOP  kadersfejp  in  the 
House  will  attempt  to  bmg  the  meas- 
ure back  to  the  House  again  tMs  year 
gwea  the  Mted  time  and  the  diSS- 
culty  of  crafting  a exnprombe  on 
s^:ch  a esmpiisx  k&s&. 

Yesterdays  vote  w'as  the  cuk&na- 
tbn  of  one  of  flic  year's  most  hotly 
, contested  lobb>dng  battles  on  Capitol 
Hill,  generating  a variety1  of  strange 
alliances  on  both  sides.  Allied  with 
the  Las  Vegas  casino  Industry  m sup- 
port of  the  MS  have  been  rdigjous 
group*  that  are  among  the  GOFs 
core  group  of  supporters,  including 
the  Chnsfian  Coalition,  the  Southern 
Baptist  Gom'tntion,  the  Family  Re- 
search Council  and  Focus  on  the 
Family. 

♦ But  the  booming  high-tech  bdus- 
try;  whkh  the  GOP  is  als-u  courting, 
had  serious  concerns,  and  a number 
of  governors  objected  that  the  legisla- 
tion would  not  proride  an  exemption 
for  stale  lotteries  to  sell  rickets  onli  ne 
within  their  own  states. 

MeanwhOe.  horse  and  dog  raring 
venues  have  been  fighting  dedbring 
attendance,  and  stiffer  comperirion 
from  other  forms  cf  betting.  They 
saw  the  felS  as  a w*ay  to  ensure  their 
long-term  smyivsl  by  allowing  them 
to  marKCv  their  events  over  the  Inter- 
net 

Goadktle  assured  House  mem- 
bra yesterday  that  the  parimutuel 

provisions  only  authorised  what  is al- 
ready kgal  under  riedera)  gambling 
law,  and  did  not  constitute  an  expan- 
sion. Action,  he  said,  wss  essential  on 
the  larger  Issue  of  earinc Kype  gam- 
Ming. 

But  the  White  House  charged  that 
bill  would  have  brightened  the  likeli- 
hood that  children  and  other  vul- 
nerable groups  would  fee  able  to  get 
unsupervised,  unlimited  access  to 
mntibfig  aoiviries  on  home  comput- 
ers. 

This  MB  appears  to  be  designed 
to  protect  certain  forms  of  Internet 
gambling  that  currently  are  tBegafe 
whik  potrnmy  opening  the  flood- 
gate for  other  forms  of  illegal  gam- 
bling/ the  White  House  S3id  in  a 
statement 


Along  with  concerns  about  the 
parimutud  betting  provisions,  some 
lawmakers  m both  parties  expressed 
reservations  about  the  extent  of  fed- 
eral incursion  into  the  prerogatives 
of  the  state 

*You  would  have  the  federal  gov- 
ernment dictate  to  Internet  service 
providers  what  services  they  can  of- 
fer/ said  Rep.  Christopher  Cox  (R- 
C&lif.)  in  opposing  the  kglsiatfom  He 
said  it  was  *w^8-mteotioned/  but 
would  ^create  enormous  regulatory' 
probkuk/ 

Goodklie  and  the  House  GOP 
leadership  sought  to  win  more  sup- 
port for  the  W with  last-minute 
changes  aimed  at  relieving  some  of 
the  concerns  of  dvfl  liberties  groups. 
Rep.  JerroM  Nadler  (D-N.Y.)  agreed 

to  support  the  legislation  onlv  after 
lanroage  vrasadded  giving  thel opera- 
tors  of  Web  rites  that  have  been  shut 
down  fey  court  order  up  to  60  days  to 
appeal  ■ 

Yesterday's  outcome  represented 
another  ina  serfesof  sometimes  awfc- 
wiird  attempts  by  Congress  to  ad- 
dress the  controversial  issue  of  reg- 
riatfog  Internet  content  The 
Supreme  Court  struck  down  as  m- 
consrit uriormfly  broad  the  1996  Corn- 
roumcatiom  Decency'  Act  which 
made  it « federal  crime  to  make  adult 
materials  av-axt^ble  to  minors  via 
computer. 

Congress  came  back  with  the 
Child  Online  Protection  Act  s nar- 
rower attempt  to  regulate  commer- 
rial  site  showing  pornography  on 
the  World  Wide  Web.  That  law  fas 
been  challenged  fey  dvfl  liberties 
^oups  and  publishers,  and  is  cur- 

before  federal  appeliatecouns. 
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‘Carnivore’  Won’t  Devour  Cyber-Privacy 


By  Bwcz  BmKomrz 
On  Monday  the  White  Hawse  propose 
nm  legislation  regulating  surveillance  by 
law  enforcement  agendas  on  the  Internet, 
But  cm!  libertarians  are  already  complain- 
m &&  toi$  plan  does  little  to  address  the 
problems  ostensibly  raised  by  Carnivore, 
the  FBI's  new  software  system  tor  perform- 
ing court-ordered  wiretaps  at  Internet  ser- 
vice providers  USPs). 

Using  a laptop  computer,  law  enforce- 
ment officials  can  hook  Carnivore  into  an 
ISP's  network.  Once  installed,  it  reads  the 
headers  of  each  e-mail  message -listing 
the  sender,  recipient  and  subject  of  the 
message- as  it  passes  through.  If  the 
sender  or  recipient  is  the  target  of  a taps 
Carnivore  records  the  message, 

Rights  at  Risk? 

Here's  the  rub:  Before  Carnivore  can 
know  whether  a message  belongs  to  a tar- 
geted party,  it  must  browse  the  headers  of 
all  the  messages  passing  through  the  ISP. 
With  a traditional  phone  tap,  law  enforce- 
ment officers  only  listened  to  the  tele- 
phone line  that  the  subject  of  the  tap  was 
using.  The  ACLU  and  other  critics  com- 
plain that  when  Carnivore  reads  the  head- 
ers of  anyone  who. is  not  a target  it  vio- 
lates their  rights. 

The  ACLU  and  other  Carnivore  critics 
need  to  get  a grip-and  a better  under- 
standing of  the  new  technology. 

Unlike  old-fashioned  analog  telephone 
calls,  e-mail  messages  are  transmitted  dig- 
itally. A computer  slices  and  dices  the  mes- 
sage into  packets,  each  with  an  identify- 
ing tag.  The  packets  then  spread  out 
throughout  the  internet,  finding  the  most 
efficient  path  to  the  destination.  When 
they  arrive,  they  are  reassembled,  and  the 
recipient  gets  the  message.  As  a result, 
with  e-mail  you  cannot  “tap  a line"  be- 
cause often  there  is*  literally,  no  particu- 
lar line  to  tap.  All  you  can  do  is  scan  the 
messages  that  pass  through  a link  a sus- 
peef  is  known  to  use -like  his  ISF-and 
pick  out  the  ones  that  belong  to  him 
Thafs  what  Carnivore  does. 

The  ACLU  complains  that  using  a com- 
puter to  monitor  an  ISP  system  would  col- 
lect vast  amounts  of  innocent  data.  But 
what  do  they  expect  toe  feds  to  use~a 
writer  ^ an  abacus?  Note  to  FBI: 
Hire  a better  public  relations  firm,  and 
name  your  next  project  "Vegetarian.” 


These  kinds  of  flaps  are  happening 
more  and  more  often.  Last  April  some  pri- 
vacy advocates  complained  when  the  FBI 
requested  $15  million  tor  “Digital  Storm/ 
a program  for  monitoring  telephone  calls 
and  analyzing  recordings*  fit  September,  a 
programmer  to  North  Carolina  found  the 
no&tion  “NSA  Key*'  in  a Microsoft  soft- 
ware patch.  Soon  rumors  bounced  through 
the  Internet  claiming  Windows  had  a back 
door  that  allows  the  National  Security 
Agency  to  monitor  your  computer,  {ML 


There's  a lot  of  concern  about  the  ability 
of  governments  to  monitor  communications 
in  tiie  digital  age , In  fact,  it's  getting  harder, 
not  easier,  for  them  to  listen  in. 


fttmot 
; tOttoM 

(vM 


emsoft  explained  that  toe  tag  merely  signi- 
fied that  the  software  complied  with  the 
agency’s  security  standards.) 

The  granddaddy  of  all  bogus  fears, 
though,  is  Echelon*  If  you  believe  some 
European  Union  parliamentarians,  the 
United  States  and  Britain  operate  an  inter- 
national network  that  monitors  virtually 
all  commum cations*  and  extracts  choice 
nuggets  with  powerful  computers  that  ret> 
ogaiae  key  phrases  in  messages  like  “as- 
sassination/ “terrorist  attack"  or  “indus- 
trial secret  / 

in  reality*,  it’s  not  easy  to  find  a specific 
message  to  a hood  of  free-flowing  digital 
data*  That’s  the  whole  reason  tor  getting  a 
court  order  for  a wire  tap.  If  you  cannot 
hook  into  an  ISP,  you  have  to  do  a lot  of 


searching  to  fmd  the  message  you  wart  ic 
intercept.  j 

Thai  is  also  why  the  European  elm- 
paign  against  Echelon  is  so  quixotic.  Tr 
the  folks  at  N$A  intercept  communicati 
and  they  have  powerful  computers  and 
genious  software  that  helps  with  toe  j 
cessing*  But  ft  is  impossible  for  even 
best  computer  system  to  routtnelv  j 
through  all  of  toe  world’s  tetommun 
Uons  &hd  pull  out  telltale  messages,  as  the 
Echelon  paranoids  would  have  you  1 
iieve. 

" " — ■ Usually  you  n 

bout  the  ability  to  know  what  you 
„ - ^ v looking  for  i 

mmmkmtons  Where  the  mess: 

getting  harder.  f**  «»*»  bef 

f * * you  have  much  o 

m,  chance  of  fmdingjfc. 

Also,  the  cases  r' 
which  one  messi 
tells  a whole  st< 

OWiv  sre  mt'  ^°°d  i 

enforcement  and 
telligence  usual  iy 
B quires  mufti] 

S0Urce5  aM  coll 
*u]  ^formation 
^ tnske  sense  of  an  j 

fercept, 

ivfj  mt5  have  the  5foJy 
revers^-  fUs  gettii 
Sfe3>j  harder,  not  cash 
for  our  law  enforc 
Biff  f mem  and  tote! 

^ gence  crpnizaftoj 

to  listen  in  on  cor 
mtmicafions.  In  l) 
old  days  you  could  tap  a line  or  intercept 
microwave  link.  It  s much  more  difficult  s 
capture  digital  messages  that  pass  ov< 
fiber  optics  or  bounce  through  cellular  m 
worfei.  And,  with  strong  encryption  sol 
ware  freely  available  world-wide,  anyor 
really  determined  to  keep  a message  $< 
tret  can  usually  do  so. 

If  you  have  any  doubts,  just  recall  hoi 
many  intelligence  surprises  we  have  ha 
lafdy-fhe  Indian  nuclear  test*  toe  Non 
Korean  missile  test,  the  terrorist  bomt 
mgs  of  American  targets  in  the  Mideas 
and  Africa,  Part  of  the  problem  is  that  w 
cannot  get  to  many  of  toe  sources  that  w 
used  to,  and  everyone  is  getting  better  a 
concealing  their  ccmmtmkafions. 
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So  why  is  K so  easy  to  stir  up  these 
»ntrosmies  about  privacy?  The  simple 
met  is  tnat  relations  between  the  govern* 
ment  and  JAe  mw  information  industries 
are  fousy  There  is  too  much  suspicion  and 
too  little  communication. 

The  administration  gets  part  of  the 
mm$  for  Us  ham  handed  policies.  Carm* 
21*  Sf™*  **m&.  A lot  of  contro- 
w ^ave  ^C€ft  defused  if  the  FBI 
nad  offered  more  insight  info  how  the  sys* 
to  worked  and  how  the  rights  of  nonius- 
peets  would  be  protected 

But  the  recart  of  the  technogeeks  has 
not  been  much  better.  Thev  often  act  as 
though  Jaw  enforcement  officials  have  no 
husasess  poking  into  their  activities  at 
au~&$  though  one  could  stop  international 
compoter  criminals  with  g good  neighbor- 
hood watch  program. 

)■  ? ~ 811 103  eaS}!  10  l9SB  of  the  fact 
tnat  Canuvore’s  main  targets  are  cvber- 
crtoinaJs-in  other  words,  the  kinds  of 
crocks  who  are  a plague  on  the  Internet 
and  target  dot-com  companies.  Growth 
rates  for  internet  shopping  have  been  siip- 
ptng  lately.  According  to  some  excerts 
wwry  about  whether  their  credit 
cart  numbers  and  health  records  are  safe. 
»ou  would  think  that  e-business  would  be 
hie  first  to  support  better  Saw  enforcement 
on  the  net 

Commas  Goals,,  , ' , 

Ail  fhe  good  guys  in  this  dispute  nave 
twnmon  goals.  Defense  and  imeUirehce 
omeiafs  warn  to  protect  the  nation’s  cam 
mmmmns  infrastructure.  Law  enforce* 
ment  officials  want  to  chase  croote>  and 
companies  want  the  cops  to  catch  them 
Consumers  warn  privacy  The  path  to  m i s 
me  same:  secure  information  systems 
reasonable  cooperation  from  the  private 

^Fess'ive  law  enforcement 
and  effective  intelligence  closely  moni- 
tored by  responsible  public  officials.  ' ; 

Fixing  the  relationship  between  Wash- 
ington and  Silicon  Valley  needs  to  be  a Iod 
TOy  for  the  next  administration I rS 
wb  people  henefitung  from  controversies 
« «»  wr  Carnivore  are  terrorists 
rTtmirtals:  und  rogue  states. 

ter-#ftemt*iscm&rck/eltowoi'iiie 

“Ri*  oottRfhor  a/  * Best 
^^MeUyence  m m infomatkm  Age” 
frofo  umwrstfy  Press,  fflOdh 
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Questions  for  the  Record 
June  20, 2000 


Senator  Kvt: 

Q;  Is  the  NIPC  able  to  proside  indications  and  warnings  of  an  attack?  For  example,  does 
the  Center  have  the  ability  to  detect  anomalous  activity  or  patterns  In  key  communications 
nodes  that  might  indicate  something  is  about  to  happen? 

The  NIPC’s  ability  to  perform  “indications  and  warning”  is  dependent  first  and  foremost 
on  its  ability  to  quickly  gather  information  from  multiple  sources  about  an  ongoing  or  imminent 
attack  (whether  an  intrusion,  a virus,  a denial  of  service,  or  other  form  of  attack).  The  NIPC 
does  not  operate  any  detection  mechanisms  on  any  government  or  civilian  systems.  Thus,  we  do 
not  get  “indications”  in  an  automated  sense  from  any  detection  devices.  In  tins  sense,  I&W  in 
the  cyber  world  is  very  different  from  I&W  in  tire  nuclear  missile  or  conventional  weapons 
world,  where  radars  and  other  devi  ces  can  provide  advanced  warning  of  an  attack.  Rather,  we 
get  relevant  information  from  intelligence  sources,  criminal  investigations,  “open  sources”  (such 
as  media  and  the  Internet),  and  from  industry  and  government  contacts.  We  “detect”  anomalous 
activity  in  key  communications  nodes  only  if  the  owner/operator  of  that  node  detects  it  and 
informs  the  NIPC,  an  FBI  Field  Office,  or  another  agency,  or  if  we  learn  through  criminal 
investigation  or  intelligence  sources  that  the  node  is  being  attacked.  Tire  key  to  the  NTPC’s 
ability  to  do  this  is  the  development  of  connectivity  and  close  interaction  with  numerous  Defense 
and  Intelligence  Watch  centers,  FBI  Field  Offices,  other  Law  Enforcement  organizations, 
computer  anti-virus  association  groups,  private  and  public  Computer  Incident  Response  Teams 
(CIETs)  and  Computer  Emergency  Response  Teams  (CERTs),  foreign  law  enforcement 
agencies,  and  private  industry  (both  individual  companies  and  information  sharing 
organizations).  Over  the  past  two  years,  the  NIPC  has  made  substantial  progress  in  developing 
these  relationships,  but  this  is  a continuing  task  and  more  work  remains  to  be  done.  One  of  the 
main  reasons  for  our  extensive  outreach  programs  is  to  build  trust  and  willingness  on  the  part  of 
private  companies  to  report  cyber  incidents  to  us,  and  these  efforts  am  bearing  fruit.  In  addition, 
PDD-63  directs  other  federal  agencies  to  report  incidents  to  the  NIPC  directly.  Many  agencies 
are  doing  this,  but  there  is  room  for  improvement  with  others.  In  addition  to  reports  from 
companies  and  agencies,  the  NIPC  Watch  actively  scans  all  available  governmental  and  private 
sector  sources  for  reports  or  information  regarding  cyber  activity1,  and  interacts  throughout  each 
day  with. other  watch  centers  to  share  information. 

♦ ‘ 

Once  information  (or  “indications”)  of  an  attack  is  received  and  analyzed,  the  NIPC  can 
issue  a warning,  alert,  or  advisory  through  numerous  means,  depending  on  the  appropriate 
audience.  Warnings  can  be  issued  to  specific  targeted  companies  through  FBI  Field  Offices  or 
by  the  watch  directly;  other  federal  agencies  can  be  notified  by  e-mail,  secure  facsimile,  and 
telex;  state  and  local  law  enforcement  can  be  warned  by  NLETS;  industry  can  be  warned  through 
InfiaGard  secure  email  and  website  and  through  ANSIR  (an  e-mail  system  that  reaches  tens  of 
thousands  of  companies);  and  fee  general  pubic  can  be  warned  via  fee  NIPC  webpage  and  the 

4- 
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news  media.  All  of  these  mechanisms  have  been  used  numerous  times  (as  discussed  in  the 
answer  to  the  next  question). 

Senator  Kyi’s  question  goes  to  the  heart  ofl&W  in  the  cyber  world:  should  the  Nation 
have  the  capability  to  detect  intrusions  into  government  or  private  sector  systems  in  an 
automated  fashion,  without  having  to  rely  on  human  detection  and  reporting?  The  controversy 
attending  the  Administration's  recent  “FHMET”  initiative,  which  is  a limited  proposal  to  place 
automated  intrusion  detection  devices  on  federal  agency  networks,  identified  many  of  the  privacy 
and  other  issues  such  a system  would  raise,  particularly  if  it  were  extended  to  privately  owned 
networks.  The  government’s  approach  at  the  present  time  is  to  encourage  industry  to  protect  and 
monitor  its  own  systems,  and  to  report  anomalous  activity  voluntarily.  The  NIPC  works  within 
that  overall  policy  to  encourage  private  sector  reporting  as  a critical  part  of  its  I&W.  Examples 
of  this  include  InfraGard  and  the  incident  reporting  pilot  program  we  have  developed  with  the 
energy'  sector  through  the  North  American  Electrical  Reliability  Council  (NERC). 

Q.  How  many  warnings  has  the  NIP C issued  which  were  developed  through  the  Centers's 
own  analysis  of  activity'? 

Of  the  54  tactical  warning  products  disseminated  since  the  NIPC  was  establi  shed  in 
February  1998,  all  were  developed  in  whole  or  in  part  through  the  Center’s  organic  analytical 
capability'  and  analysis  of  activity.  Some  of  these  products  were  initiated  by'  the  NIPC  (e.e.,  the 
BAT/Firkin  Worm,  also  known  as  the  ,!91 1”  Worm),  while  others  built  upon  basic  analysis  ’ 
initiated  elsewhere  (e.g.,  the  NIPC  assessments  of  Distributed  Denial  of  Sendee  tools).  We 
cannot  put  a precise  figure  on  the  relative  contributions,  since  these  are  all  comm  unity- 
collaborative  products.  In  performing  analyses  and  issuing  warnings,  the  NIPC  works  closely 
with  other  government  agencies,  private  sector  organizations  such  as  CERT  (which  is  an  FBI 
contractor),  and  the  SANS  institute,  and  academic  institutions. 

In  addition  to  warning  products,  the  Center  has  produced  hundreds  of  non-warning 
informational  products.  Since  1998  the  NIPC  has  produced  301  daily  reports,  30  CyberNotes  (a 
summary  and  analysis  of  technical  exploi  ts  and  vulnerabilities),  5 1 Critical  Infrastructure 
Developments  reports  (a  report  on  recent  cyber-related  issues  and  incidents),  and  five  IP  Digests 
(a  periodic,  in-depth  analysis  of  cyber  threats  and  vulnerabilities).  Versions  of  these  analytical 
products  go  to  private  industry,  to  the  Intelligence  Community,  other  federal  agencies  (including 
law  enforcement),  and  to  criminal  investigators. 

< 

Q:  What- other  agencies  do  you  see  playing  a significant  role  in  the  area  of  computer  crime 
investigations?  _ 

Cyber  crime  is  an  issue  that  concerns  not  just,  the  FBI,  and  not  just  law  enforcement 
generally.  Indeed,  "cyber  crime”  in  itself  should  be  seen  as  part  of  a broader  array  of  cyber 
threats,  including  cyber  terrorism,  cyber  espionage,  and  information  warfare,  since  all  are  closely 
related  and  often  difficult  to  distinguish  at  the  outset  of  an  incident.  As  a result,  cyber  threats  are 
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of  great  concern  to  numerous  federal  agencies,  including  the  Defense,  Intelligence,  and  Law 
Enforcement  Communities  and  to  civilian  "Lead  Agencies”  under  FDD-63;  to  state  and  local 
governments,  including  law  enforcement;  and,  of  course,  to  the  private  sector.  It  is  because  of 
this  wide-ranging  interest  that  the  NIPC  was  established  as  an  interagency  center.  The  NIPC 
provides  a locus  and  mechanism  for  coordinating  the  expertise  and  roles  of  many  agencies,  and 
fadhtates  infonnarion  sharing  and  operational  coordination.  Tire  NIPC  works  closely  on  ’ 
investigative  matters  with  many  law  enforcement  agencies,  including:  die  Secret  Sendee 
Internal  Revenue  Service  (IRS),  Air  Force  Office  of  Special  Investigations  (AFOSI)  Naval 
Criminal  Investigative  Service  (NOS),  United  States  Air  Force  Office  of  Special  Investigations 
(AFOSI),  Defense  Criminal  Investigative  Service  (DCIS),  National  Aeronautics  and  Space 
Administration  Office  of  Inspector  General  (NASA  GIG),  Department  ofEnergy  (DOE),  state 
and  local  law  enforcement,  foe  Intelligence  Community,  as  well  as  foreign  law  enforcement 
agencies  through  FBI  Legal  Attaches  (LEGATS).  * * ” 

there  reasons,  other  than  funding,  which  have  caused  other  agencies  to  pull  their 
personnel  out  of  the  MFC?  For  example  does  FBI  management  at  the  Center  recognize 
th  e expertise  of  the  other  agencies  and  allow  them  to  fully  participate? 

One  of  the  difficulties  in  attempting  to  operate  an  interagency  Center  is  ensuring  that  all 
relevant  agencies  participate.  Agencies  have  not  received  direct  funding  to  participate  in  foe 
Center,  and  so  must  take  detailees  to  the  NIPC  out  of  existing  personnel  resources.  In  addition 
personnel  with  cyber  expertise  are  unfortunately  in  very  short  supply,  meaning  that  agencies 
must  commit  to  take  scarce  resources  and  send  them  outside  their  agencies.  Despite  these 
impediments,  numerous  agencies  have  sent  detailees  to  the  NIPC,  including:  Defense/Office  of 
the  Secretary'  of  Defense;  Central  Intelligence  Agency;  National  Security  Agency;  Air  Force 
Office  of  Special  Investigations;  U.S.  Navy;  U.S.  Army;  U.S!  Postal  Sendee;  Defense  Criminal 
Investigative  Service;  Genera!  Services  Administration;  U.S.  Air  Intelligence  Agency; 
Department  of  Commerce,  and  foe  Tuscaloosa,  AL  SherifF s office.  In  addition,  we  have  foreign 
liaison  representatives  from  two  aliied  countries  who  assist  in  coordinating  international 
activities  with  our  counterparts.  A representative  from  FAA  is  also  scheduled  to  start  at  foe  end 
of  June.  Additional  representative  from  DoD,  CIA,  and  NSA  are  also  slated  to  anive  in  foe  near 
futnre.  We  are  also  expecting  representatives  from  local  Washington  area  police  departments  on 
a paii-tlme  basis,  ~ 


Some  agencies  were  represented  earlier  but  do  not  currently  have  representatives 
Circumstances  necessitated  foe  recall  of  foe  first  State  Department  representative.  State  agreed 
to  do  so,  and  has  committed  to  NIPC  that  it  would  replace  him  with  two  new  representatives 
DoE’s  first  representative  rotated  back  after  more  than  two  years,  NIPC*s  understanding  as  to 
why  this  representative  rotated  back  is  that  he  was  at  NIPC  for  a lengthy  time  and  was  needed  at 
DoE  headquarters  to  assist  in  a DOE  reorganization.  DoE  has  committed  to  replacing  that 
detailee,  „ * 

Secret  Service  earlier  had  two  detailees  to  the  NIPC,  but  recalled  those  detailees  and  has 
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not  yet  committed  to  replacing  them.  Secret  Service  has  not  provided  any  written  explanation  for 
this,  but  in  oral  discussions.  Secret  Service  officials  stated  that  USSS  was  not  getting  additional 
fending  for  its  electronic  crimes  program  despite  its  participation  in  NIPC;  the  FBI  was  receiving 
more  media  attention  in  the  cyber  crime  area;  and  NIPC  had  not  "referred"  cases  to  Secret 
Service  for  investigation.  NIPC  offered  any  support  it  could  give  to  Secret  Service  in  addressing 
budget  requests;  noted  feat  NIPC  public  statements  often  referred  to  partnership  wife  USSS;  and 
offered  to  do  more  to  support  USSS  initiatives  wife  public  statements  and  case  analyses.  NIPC 
also  stated  (as  discussed  further  below-)  feat  its  role  is  not  to  create  and  "refer"  cases;  rather,  cases 
generally  originate  in  Field  Offices,  and  FBI  and  Secret  Service  field  offices  frequently  work 
computer  crime  cases  together. 

NIPC  felly  recognizes  the  value  other  agencies  bring  to  fee  cyber  crime  and  infrastructure 
protection  mission.  That  is  why  NIPC  is  an  interagency  Center,  and  has  senior  managers  from 
other  agencies  in  addition  to  investigators  and  analysts.  For  instance,  fee  MPC  Deputy  Director 
is  from  DoD/OSD;  the  Section  Chief  of  fee  Analysis  and  Warning  Section  is  from  CIA;  the 
Assistant  Section  Chief  of  the  Computer  Investigations  and  Operations  Section  is  from  Air  Force 
OSI;  the  Unit  Chief  of  fee  Analysis  and  Information  Sharing  Unit  is  from  NSA;  and  the  Unit 
Chief  of  fee  Watch  and  Warning  Unit  is  from  the  U.S.  Navy.  Secret  Service  fomrally  occupied 
the  position  of  Assistant  Section  Chief  of  the  Training,  Outreach,  and  Strategy  Section. 
Recognition  of  the  need  for  other  agency  participation  is  also  what  drives  NIPC  to  continually 
seek  additional  representatives  from  other  agencies.  It  is  also  reflected  in  the  numerous  joint 
inv  estigations  that  NIPC  and  FBI  Field  Offices  have  been  involved  in  with  other  agencies  fas 
discussed  further  below). 


Qj  How  many  criminal  investigations  have  been  referred  from  the  NTPC  to  these  other 
agencies?  Does  the  Center  have  operating  procedures  to  refer  a case  to  another  agency'' 

v * 


As  a general  matter,  the  NIPC  does  not  "refer"  cases.  Cases  are  normally  initiated  by  a 
field  office,  whether  a Field  Office  of  the  FBI,  the  Secret  Service,  another  federal  agency,  or  a 
state  or  local  law  enforcement  agency.  NIPC  is  the  "program  manager"  of  fee  FBI’s  computer 
intrusion  investigative  program,  and  so  receives  information  about  cases  directly  from  the  FBI 
Field  Offices.  Under  FDD  63,  other  agencies  are  also  supposed  to  report  information  about 
cyber  incidents  to  fee  NIPC.  Sometimes,  NIPC  wall  receive  fee  first  report  of  a cyber  incident 
from  a private  company,  a government  agency,  or  another  source,  and  contact  fee  appropriate 
FBIField  Office.  If  another  agency  has  concurrent  investigative  jurisdiction  or  some  other  non- 
investigative  interest,  feat  agency  will  also  be  contacted  (either  by  fee  FBI  Field  Office  of  the 
NIPC).  Where  j oint  jurisdiction  exists,  fee  FBI  field  office  may  work  jointly  wife  the  relevant 
other  agencies  (as ^ discussed  fkther  below). 


If  an  inquiry  determines  fee  complaint  does  not  fell  within  the  investigative  guidelines  of 
fee  FBI,  it  may  be  referred  by  fee  field  office  to  another  federal  agency  ox  to  a state  or  local  law 
enforcement  agency  which  has  fee  authority  to  conduct  such  investigations,  FBI  field  offices 
develop  liaison  contacts  wife  federal,  state  and  local  agencies  investigating  similar  violations 


under  federal  or  state  statutes  and  complaints  are  disseminated  through  these  liaison  contacts. 
There  is  no  system  established  to  track  how  many  complaints  have  been  sent  front  FBI  field 
offices  to  other  law  enforcement  agencies. 

There  have  been,  however,  several  instances  in  which  the  NTPC  or  an  FBI  field  office  has 
contacted  another  agency  to  determine  if  that  agency  wanted  to  conduct  an  investigation  either 
jointly  or  separately,  but  th  at  agency  declined.  A couple  of  examples  are  listed  below. 

In  May  2000,  the  FBI’s  Detroit  Field  Office  referred  a complaint  to  the  local  Secret 
Service  office  regarding  a denial  of  service  attack  against  NHL.com,  going  so  far  as  to  transfer 
the  call  from  the  FBI  field  office  to  die  Secret  Service  field  office.  The  Secret  Service  told  the 
complainant  that  no  one  was  in  the  office  to  receive  the  complaint  due  to  a visit  of  Texas 
Governor  George  W,  Basil  to  Michigan.  The  complainant  then  called  the  FBI  again  and  the 
Detroit  Field  Office  took  the  complaint  and  assigned  the  matter  for  investigation. 

Also  in  May  2000,  based  on  FBI  source  information,  the  NIPC  notified  the  USSS 
headquarters  that  there  may  be  a vulnerability  with  the  Mute  House  Webpage  that  gave  the 
public  access  to  all  the  files  on  that  server.  The  USSS  advised  that  the  system  administrator  mav 
already  be  aware  of  this.  Neither  the  NIPC  nor  the  FBI’s  Washington  Field  Office  has  heard  " 
back  from  the  USSS  regarding  this  matter. 

In  another  instance,  the  FBI’s  Williamsport,  Resident  Agency,  part  of  the  Philadelphia 
Field  Office,  opened  an  investigation  into  a series  of  computer  intrusion  into  10  companies 
resulting  in  the  loss  of  approximately  28,000  credit  card  numbers.  During  the  initial 
investigation,  the  FBI  discovered  that  one  of  the  victims  located  in  Buffalo,  NY,  had  contacted 
the  Secret  Service  and  the  USSS  had  opened  a case  pertaining  to  the  intrusion  against  the  single 
victim  company,  but  was  not  investigati  ng  tire  larger  set  of  theft  s.  The  FBI  contacted  the  Secret 
Service  Division  in  Buffalo,  NY  tp  coordinate  the  case,  since  USSS  already  had  a pending 
investigation.  The  FBI  was  told  that  due  to  the  Security  Detail  Duties  for  the  First  Lady,  the 
USSS  would  be  unable  to  coordinate  at  the  present  time  with  the  FBI  on  the  case. 

Q.  In  previous  testimony  before  this  subcommittee  Mr.  Vatis  has  stated  that  the  NIPC  has 
referred  approximately  800  cases  for  criminal  Investigation.  How  many  of  these  800  cases 
actually  Involved  a real  threat  to  our  nation’s  critical  infrastructure?  Would  yon 
catagorize  the  recent  Denial  of  Service  attacks  launched  last  month  as  an  attack  on  our 
nation’s  critical  infrastructure? 

' * • 

In  previous  testimony  before  the  sub  committee,  the  approximate  800  numb  er  of  cases 
that  Mr.  Vatis  referenced  were  not  cases  the  NIPC  “referred,”  hut  was  the  numb  er  of  computer 
intrusion,  denial  of  service,  or  virus  eases  pending  in  FBI  field  offices  at  the  time  of  testimony. 

As  of  May  1,  2000  there  were  1,072  pending  investigative  cases.. 
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The  nation  s critical  infrastructures”  are  those  physical  and  cyber-based  systems 
essential  to  the  minimum  operations  of  the  economy  and  government,  including 
telecommunications,  energy,  banking  and  finance,  transportation,  water  systems  and  emergency 
services,  both  governmental  and  private.  One  of  the  most  difficult  aspects  of  cyber 
investigations  is  that  it  is  not  clear  at  the  outset  what  the  extent  of  the  threat,  or  the  potential 
damage  to  networiss,  is.  Each  case  must  be  thoroughly  investigated  to  determine  the  level  of 
tbreat  and  compromise.  What  seems  like  a relatively  minor  incident  might  ton  out  to  be  very 
significant,  and  vice  versa.  This  means  that  it  is  much  more  difficult  for  field  investigators  to  use 
traditional  investigative  thresholds  in  determining  how  to  utilize  scarce  resources.  Moreover, 
computer  systems  and  networks  employ  trusted  relationships  between  other  computer  system  and 
networks,  based  upon  the  users'  pri  vileges.  If  a computer  system  or  network  is  root-level  (or 
super  user)  access  compromised,  the  threat  potential  is  substantial,  and  could  theoretically  pose  a 
major  threat  to  other  trusted  systems.  This  means  that  “critical  infrastructure”  systems  are  often 
connected  with,  and  affected  by,  systems  that  are  in  and  of  themselves  not  critical. 

The  existing  NIPC  database  does  not  classify  cases  by  critical  infrastructure  at  this  time. 
Thus  of  these  1,072  cases,  there  is  no  methodology  to  determine  which  ultimately  constitute  a 
threat  to  our  nation’s  critical  infrastructure.  However,  we  can  cite  several  examples. 

The  Distributed  Denial  of  Service  (DDOS)  attacks  launched  in  February  of  this  year  are  a 
good  example  of  the  difficulty  of  categorizing  an  attack  as  an  “infrastructure”  attack  or  some 
lesser  sort  of  attack.  In  a Distributed  Denial  of  Services  attack,  not  only  are  the  "victim”  systems 
affected,  but  also  the  thousands  of  computer  systems  and  networks  that  were,  unknowingly, 
infiltrated  and  used  to  carry  out  the  attack,  and  Internet  Service  Providers  that  were  heavily 
trafficked  during  the  attack.  All  of  the  computer  systems  and  networks  that  participated  in  the 
attack  were  compromised.  Moreover,  even  though  tire  effect  of  the  attacks  was  relatively 
ephemeral  and  brief,  the  knowledge  gained  by  analyses  of  these  attacks  is  critical  to  our  ability  to 
protect  against  more  devastating  attacks  in  the  future.  If  the  DDOS  attacks  had  been  directed  * 
against  the  major  Internet  hubs  rather  than  against  primarily  e-commerce  companies,  traffic  on 
the  Internet  could  have  been  paralyzed,  disrupting  several  of  the  critical  infrastructures  that  rely 
on  the  Internet  for  communication. 

Q*  Besides  Solar  Sunrise  and  Moonlight  blaze,  what  other  joint  investigations  can  you 
point  to  that  demonstrate  successful  interagency  cooperation? 

* 

Sinpe  the  founding  of  the  NIPC  in  February  1998,  there  are  numerous  cases  which  have 
demonstrated  successful  interagency  cooperation  other  than  the  significant  Solar  Sunrise  and 
Moonlight  Maze  cases.  The  importance  of  these  too  cases  should  not  be  overlooked,  however. 
Both  represent  sipificant  milestones  in  building  awareness  of  the  cyber  threat  among  federal 
agencies  and  poficymafcets,  demonstrated  significant  vulnerabilities  in  DoD  and  other 
government  systems,  and  presided  opportunities  to  test  and  improve  the  NIPC’s  processes  for 
interagency  coordination. 
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The  following  eases  represent  a small  sample  of  these  cases  which  have  been 
successfully  worked  with  other  agencies: 

DDOS:  Numerous  Internet  commerce  sites  have  been  victimized  by  DDOS  attacks  since 
February  7, 2000,  These  DDOS  attacks  prevented  the  victims  from  offering  their  web  services 
on  the  Internet  to  Intimate  users,  A DDOS  attack  uses  compromised  computer  networks  to 
iiood  a victim  s computer  network  with  massive  amounts  of  data,  which  causes  the  victim’s 
computer  network  to  become  overwhelmed  and  to  stop  operating.  The  DDOS  attack 
investigation  are  investigations  in  seven  FBI  field  offices,  five  overseas  Legal  Attache  offices 
other  government  agencies  such  as  NASA  as  well  as  the  Royal  Canadian  Mounted  Police,  ’ 
Reflecting  the  extraordinary  level  of  cooperation  on  these  investigations,  on  April  15, 2000  the 
Canadian  officials  arrested  a juvenile  charging  him  with  one  of  the  attacks. 

Qi  radon  On  March  1, 2000,  a computer  hacker  using  the  name,  "Curador",  allegedly 
compromised  multiple  E-commerce  websites  in  the  US,  Canada,  Thailand,  Japan  and  the 
United  Kingdom,  and  apparently  stole  as  many  as  28,000  credit  card  numbers.  Thousands  of 
credit  card  numbers  and  expiration  dates  were  posted  to  various  Internet  websites  On  March  9 
2000,  IntemetNews  reported  that  Curador  stated,  "Law  enforcement  couldn’t  hack  their  way  out 
of  a wet  paper  bag.  They're  people  who  get  paid  to  do  nothing.  They  never  actually  catch 
anybody.”  After  an  extensive  international  investigation,  on  March  23, 2000,  the  FBI  assisted 
theDyfed  Powys  (UK)  Police  Service  in  a search  at  the  residence  of  Curador;  Curador,  age  18, 

V?’. a!on§  with  m aPParent  co -conspirator  under  the  Computer  Misuse  Act 
1 990.  L nder  United  Kingdom  lav,',  both  males  have  been  dealt  with  as  adults.  Loss  estimates 
are  still  bemg  determined, 

- This  case  was  predicated  on  the  investigative  work  by  the  Dyfed  Powys  Police  Service 
the  Federal  Bureau  of  Investigation,  internet  security  consultants,  the  Royal  Canadian  Mounted 
Po  ice,  and  the  international  banking  and  credit  card  industry'.  Tins  case  illustrates  the  benefits 
of  law  enforcement  and  private  industry,  around  the  world,  working  together  in  partnership  on 
computer  crime  investigations,  * 


Burns.  In  August  1998,  the  FBI  initiated  an  investigation  on  an  individual  only  known  as 
"zyklon,”  who  conducted  numerous  computer  intrusions  to  various  computer  systems  causing 
damages  to  websites  and  system  files.  The  case  was  worked  in  cooperation  with  the  Virginia 
State  Police.  The  investigation  identified  zyklon  to  be  Eric  Bums  of  Shoreline,  Washington.  In 

f,  9*  f°Il0Wing  20  executi0Q  of  a search  warrant,  Bums  confessed  to  the  intrusions  In 

May  1999,  Bums  also  gamed  unauthorized  access  and  defaced  the  webpage  for  the  White  House 
website.  At  that  point  the  FBI  began  working  with  the  U.S.  Secret  Service  on  the  case.  In 
September  1999,  Bums  pleaded  guilty  to  one  count  for  violation  of  Title  18  USC  Section  1030 
(Computer  Fraud  and  Abuse)  for  one  of  the  1998  intrusions.  In  the  plea  agreement.  Bums  also 
admitted  his  comma!  activity  mto  several  other  intrusions  including  the  White  House  website  In 

J^VoTnber  i9"’ Buras  was  scntcaced  to  15  mon&s  in  prison,  3 years  supervised  release  and 
$36,240  m restitution  and  a $100  fine. 


-7- 


5/24/02  Release 


Xdfero:  This  investigation  was  worked  jointly  with  the  Middletown  Rhode  Island  Police 
Department,  the  state  Office  of  the  Inspector  General  (GIG),  National  Aeronautics  and  Space 
Administration  (NASA),  and  the  FBI.  Sean  Trifero  compromised  various  company  and 
University  computer  systems,  including  systems  maintained  by  Harvard  University,  Amherst 
Co  lege,  Internet  Services  of  Central  Florida,  Aliant  Technologies,  Arctic  Slope  Regional 
Corporation  and  Barrows  Cable  Company,  He  would  utilize  these  compromised  systems  to 
establish  web  pages,  E-Mail  and  Internet  Relay  Chat  (IRQ  Groups  in  the  background  of  the 
victim, s ^P^^systjm  Infer©  would  also  provide  others  wife  access  to  these  compromised 
systems.  On  10/6/1998,  Trifero  entered  a guilty  plea  in  fee  District  of  Rhode  Island  in 
connection  wife  this  matter.  On  2/22/1999,  Trifero  was  sentenced  in  connection  with  his  guilty 
plea  to  five  counts  of  violating  Titlelg  United  States  Code,  Section  1030.  He  was  sentenced  to: 
months  plus  1 day  in  jail;  $32,650.54  in  restitution;  S500  special  assessment;  three  years 
supervised  release;  five  hours/wk  community  service  for  36  months;  use  of  the  Internet  but  no 

contact  with  members  of  any  hacking/cracking  group. 

Msmm:  Throughout  1996,  National  Oceanic  and  Atmospheric  Administration  (NOAA) 
suffered  several  computer  intrusions  which  were  also  linked  to  intrusions  occurring  a the 

tartiwfm*  SH  (NASA)'  ^ inirusions  coattacd 

through  1997.  The  FBI  worked  the  ease  jointly  with  NOAA.  NASA,  and  the  Canadian 

authorities  and  identified  the  subject,  Jason  G.  Mewhiney,  who  resided  in  Canada.  The  original 

damage  assessment  feat  Mewhiney  had  caused,  exceeded  $40,000.  In  April  1999,  Jason  G. 

Mewhiney  was  indicted  by  Canadian  authorities.  In  January  2000,  Mewhiney  pleaded  guilty  to 

counts  of  intrusions  which  included  violations  spanning  from  May  1996  through  Aorii  1997 

of  destroyed/altered  data  and  intrusions  with  the  intent  to  damage.  In  the  Canadian  Superior 

Court  of  Justice,  Mewhiney  was  sentenced  to  6 months  in  jail  for  each  of  the  counts  to  ran 
concurrently.  ' 

lliss:  In  February,  1998,  the  FBI  opened  an  investigation  to  assist  the  U.S.  Air  Force  and  US. 
^avy  regarding  multiple  computer  intrusions.  The  case  was  worked  jointly  with  the  U S Naval 
Cnmraal  Investigative  Service  and  Florida  State  Attorney's  Office  in  Jacksonville,  FL.  * The 
subject  was  identified  as  Jesse  Le  Bliss,  a student  of  the  University  of  North  Florida.  On  August 

2I’- 1 !S^1SS?eaded  §mty  t0  °ne  felony  count  violation  of  Florida  State  Statute  815  06 

entitled  Offense .Against  Computer  Users,  On  September  19, 1998,  Bliss  was  sentenced  in  fee 
Fotnth  Judicial  Circuit,  S tate  of  Florida,  to  six  months  house  arrest  followed  by  three  vears 

™***ty> semce,  and  a written  letter  of  apology  to  fee  Commandant 
of  the  United  States  Marine  Corps, 

CD, Universe:  One  pending  case  being  worked  by  the  FBFs  New  Haven  Division  and  the  U.S. 
Secret  Service  has  been  widely  reported  in  the  press,  due  to  statements  made  to  reporters  by  the 
alleged  perpetrator.  In  December  1999,  fee  FBFs  New  Haven  Division  opened  a case  into  fee 
mfiusions  into  fee  computers  of  CD  Universe,  an  on-line  music  seller,  and  fee  theft  of  customers’ 
credit  card  numbers  and  a related  extortion  attempt.  Because  of  fee  credit  card  aspect  fee  FBI 
called  the  USSS  to  ask  if  USSS  wanted  to  investigate  jointly.  The  USSS  declined.  In  January 
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2000,  the  New  York  Times  ran  a front  page  story  about  the  case,  based  on  conversations  between 
the  reporter  and  the  alleged  perpetrator.  Subsequently,  USSS  called  the  FBI  back  and  requested 
to  work  the  case  jointly.  That  case  is  still  pending.  • 

Other 

There  are  other  investigations  that  are  being  conducted  with  other  agencies,  however 
further,  details  may  adversely  impact  the  investigation  due  to  their  pending  status.  There  are 
currently  47  pending  investigative  cases  which  are  being  worked  jointly  between  the  FBI  and  the 
multiple  entities  of  the  Department  of  Defense.  An  additional  58  cases  were  investigated  jointly 
with  other  entities  that  are  now  in  closed  status. 
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Senator  Fdnstem: 

I.  Under  Presidential  Decision  Directive  63  (PDD  63),  the  .[sic...  NIPCJ...  is  supposed  to 
take  the  lead  in  naming  of,  investigating,  and  responding  to  threats  to  or  attacks  on  this 
country  s critical  infrastructures.  NTPC  includes  representatives  from  the  FBI  and  other 
law  enforcement  agencies.  Yon  testified  that  the  NIPC  has  improved  the  FBI's  ability  to 
fight  cybercnme  and  that  the  FBI  closed  912  cybercrime  cases  in  the  Fiscal  Year  1999  and 
had  834  pending  cybercrune  cases  that  yean 

How  many  of  the  912  closed  cases  involved  threats  to  or  attacks  on  our  nations's  critical 
infrastructures?  Were  these  cases  really  a threat  to  our  national  security?  What  about  the 

pending  cases?  How  many  involved  threats  to  or  attacks  on  oar  nation's  critical 
infrastructures? 

. yhe  nation’s  “critical  infrastructures”  are  those  physical  and  cyber-based  systems 
essential  to  the  minimum  operations  of  the  economy  and  government,  including 
te  eeommumcations,  energy,  banking  and  finance,  transportation,  water  systems  and  emergency 
services,  both  governmental  and  private.  One  of  the  most  difficult  aspects  of  cyber  ' 

investigations  ts  that  it  is  not  clear  at  the  outset  what  the  extent  of  the  threat,  or  the  potential 
damage  to  networks,  is.  Each  case  must  be  thoroughly  investigated  to  determine  the  level  of 
threat  and  compromise.  What  seems  like  a relatively  minor  incident  might  turn  out  to  fee  very 
significant,  and  vice  versa.  This  means  that  it  is  much  more  difficult  for  field  investigators  to  use 
traditional  investigative  thresholds  in  determining  how  to  utilize  scarce  resources.  Moreover 
computer  systems  and  networks  employ  trusted  relationships  between  other  computer  system  and 
ne  vorks,  based  upon  the  users'  privileges.  If  a computer  system  or  network  is  root-level  for 
super  user)  access  compromised,  the  threat  potential  is  substantial,  and  could  theoretically  pose  a 
major  threat  to  other  trusted  systems.  This  means  that  ‘'critical  infrastructure"  systems  are  often 
connected  with,  and  affected  by,  systems  that  are  in  and  of  themselves  not  critical 

The  existing  NIPC  database  does  not  classify  cases  by  critical  infrastructure  at  this  time. 
Thus,  there  is  no  methodology  to  determine  which  eases  ultimately  constitute  a threat  to  our 
nation’s  cntical  infrastructure. 

The  Distributed ^emal  of  Sendee  (DDOS)  attacks  launched  in  February  of  this  year  are  a 
good  example  ofthe  difficultyof  categorizing  an  attack  as  an  “Infrastructure”  attack  or  some 
st°?ofafac^  111 2 Distributed  Denial  of  Sendees  attack,  not  only  are  the  ''victim"  systems 
affected,  but  also  the  thousands  of  computer  systems  and  networks  that  ware,  unknowinely 
infiltrated  and  used  to  cany  out  the  attack,  and  Internet  Service  Providers  that  were  hem! y 
trafficked  during  She  attack.  All  of  the  computer  systems  and  networks  that  participated  in  the 
attack  were  compromised.  Moreover,  even  though  the  effect  ofthe  attacks  was  relatively 
ep  emeral  and  brief,  the  knowledge  gained  by  analyses  of  these  attacks  is  critical  to  our  ability  to 
protect  against  more  devastating  attacks  in  the  future.  If  the  DDOS  attacks  had  been  directed 
against  the  major  Internet  hubs  rather  than  against  primarily  e-commerce  companies,  traffic  on 
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the  Internet  could  have  been  paralyzed,  disrupting  several  of  the  critical  infrastructures  that  rely 
on  die  Internet  for  communication. 

2*  In  testimony  last  February  16,  you  said  that  the  FBI  was  producing  "fast-developing 
leads’  and  that  a break  in  the  case  was  imminent.  A couple  of  weeks  later,  Michael  Vatis, 
director  ofNIPC,  suggested  that  in  fact  agents  were  making  slow  progress  in  the  case. 

How  would  yon  assess  progress  la  the  case  now? 

In  fact,  the  testimonies  of  FBI  Director  Freeh  and  NIPC  Director  Vatis  were  entirely 
consistent.  Both  cited  the  difficulties  in  conducting  cyber  crime  investigations,  but  both  also 
expressed  optimism  about  the  prospects  for  a successful  resolution  of  the  case.  Director  Freeh’s 
February  16  testimony  for  the  record  contained  the  following  remarks  about  the  DDOS 
investigation: 

On  February^  8, 2000,  the  FBI  received  reports  that  Yahoo  had  experienced  a 
denial  of  sendee  attack.  In  a display  of  the  close  cooperative  relationship  the 
N1PC  has  developed  with  the  pri  vate  sector,  in  the  days  that  followed,  several 
other  companies  also  reported  denial  of  service  outages.  These  companies 
cooperated  with  our  National  Infrastructure  Protection  and  Computer  Intrusion 
squads  in  the  FBI  field  offices  and  provided  critical  logs  and  other  information. 

Still,  the  challenges  to  apprehending  the  suspects  are  substantia!.  In  many  cases, 
the  attackers  used  “spoofed”  IP  addresses,  meaning  that  the  address  that  appeared 
on  the  target’s  log  was  not  the  true  address  of  the  system  that  sent  the  messages. 

The  resources  required  in  these  investigations  can  be  substantial.  Already  we 
have  five  FBI  field  offices  with  cases  opened  : Los  Angeles,  San  Francisco, 

Atlanta,  Boston,  and  Seattle.  Each  of  these  offices  has  victim  companies  in  its 
jurisdiction.  In  addition,  so  far  seven  field  offices  are  supporting  the  five  offices 
that  have  opened  investigations.  The  NTPC  is  coordinating  the  nationwide 
investigative  effort,  performing  technical  analysis  of  logs  from  victims  sites  and 
Internet  Service  Providers,  and  providing  all-source  analytical  assistance  to  field 
offices.  Agents  from  these  offices  are  following  up  literally  hundreds  of  leads. 

While  the  crime  may  be  high  tech,  investigating  it  involves  a substantial  amount 
of  traditional  police  work  as  well  as  technical  work.  For  example,  in  addi  tion  to 
following  up  leads,  MFC  personnel  need  to  review  an  overwhelming  amount  of 
log  information  received  from  the  victims.  Much  of  this  analysis  needs  to  be  done 
manually.  Analysts  and  agents  conducting  this  analysis  have  been  drawn  off 
other  case  work.  In  the  coming  years  we  expect  our  case  load  to  substantially 
increase.  (Emphases  added.)  ' V 

NIPC  Director  Vatis’  February  29  testimony  for  the  record  contained  the  following 
statement  about  the  DDOS  investigation: 
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. 0n  Februaf>"  g>  2000,  the  NIPC  received  reports  that  Yahoo  had 
experienced  a denial  of  sendee  attack.  In  a display  of  the  close  cooperative 
relationship  that  we  have  developed  with  the  pri  vate  sector,  in  the  days  that 
followed,  several  other  companies  (including  Cable  News  Network,  eBay 

«m^nd  ZDNE1)’  4150  r^orted  °f! «vi«  outages  to 

the  NIPC  or  FBI  field  officer.  These  companies  cooperated  with  us  by  providing 
raucal  logs  and  other  mfonuafion.  Still,  the  challenges  to  apprehending  the  * 

• susPe are  substantial-  In  many  eases,  the  attackers  used  “spoofed”  IP  addresses 
meaning  that  the  address  that  appeared  on  the  target’s  log  was  not  the  true  address  ’ 
of  the  system  that  sent  the  messages.  In  addition,  many  victims  do  not  keep 
complete  network  logs.  r 

The  resources  required  in  an  investigation  of  this  type  are  substantial 
Companies  have  Been  victimized  or  used  as  “hop  sites”  m numerous  places  across 
the  country  meaning  that  we  must  deploy  special  agents  nationwide  to  work  leads 
We  currently  have  seven  FBI  field  offices  with  cases  opened  and  all  the  remaining 
oftices  are  supporting  the  offices  that  have  opened  cases.  Agents  from  these 
offices  are  following  up  literally  hundreds  of  leads.  The  NIPC  is  coordinating  toe 
nationwide  investigative  effort,  performing  technical  analysis  of  logs  from  victims 
sites  and  Internet  Sendee  Providers  (ISPs),  and  providing  an-soure^  analytical 
assistance  to  field  offices.  Moreover,  parts  of  the  evidentiary  trail  have  led 
overseas,  requiring  us  to  work  with  our  foreign  counterparts  in  several  countries 
through  our  Legal  Attaches  (LEGATs)  in  US.  embassies. 

While  the  crime  may  be  high  tech,  investigating  it  involves  a substantial 
amount  of  traditional  investigative  work  as  well  as  highly  technical  work. 

Interviews  of  network  operators  and  confidential  sources  can  provide  very  useful 
information,  which  leads  to.  still  more  interviews  and  leads  to  follow-up.  And 
victim  sites  and  ISPs  provide  an  enormous  amount  of  log  information  that  needs  to 
be  processed  and  analyzed  fay  human  analysts. 

Despite  these  challenges,  1 am  optimistic  that  the  hard  work  of  our  agents 
analysts  and  computer  scientists;  the  excellent  cooperation  and  collaboration  we 
have  with  private  industry  and  universities;  and  the  teamwork  we  are  engaged  in 
with  foreign  partners  will  in  the  end  prove  successful  (Emphases  added.) 

M “f, FBr’.^Tff COn,i“C,ed  Cl0Se  coo"fi“fi“  «H»  <he  Royal  Canadian 
Momted  Police,  very  quidd,  bad  resulted  tp  the  identification  of  one  subject  in  Canada  Because 

nKidt,?  ^ S??*4  by  RCMP 'm  *<=  DDOS'eise  and  in  another  matter 
that  came  to  light  during  the  RCMP  s investigation,  the  subject  could  not  be  immediately  arrested, 

RCMP  £1“?®! ‘ not  be  discussed  publicly.  However,  on  April  15.40 

executed  a search  warrant  and  arrested  a juvenile  charging  him  wife  one  of  fee  attacks. 
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We  would  therefore  assess  the  progress  in  this  ease  as  substantial  and,  indeed 
unprecedented  m a ease  of  tlm  scope  and  nature.  The  investigation  continues  into  the  attacks  o; 
DDOS  victims,  and  we  believe  good  progress  continues  to  be  made. 

3,  In  twfimony  last  February  16,  you  suggested  that  the  FBI’s  resources  ’’are  stretched 
paper^m_  because  of  the  lack  of  high-caliber  government  forensic  computer  experts. 

How  much  has  this  contributed  to  the  government’s  lack  of  success  in  catching  the 


M cussed  ^°y«>  substantial  progress  in  fact  has  been  made  in  the  DDOS  investigation 

with  one  subject  already  identified  in  Canada.  “ ’ 

„ ^ *n"f  explosive  growth  in  computer  crimes,  our  existing  resources  both  in 

le  Computer  Analysis  Response  Team  and  in  the  MFC  and  the  related  field  office  National 
Infrastructure  Protection  and  Computer  Intrusion  Program  are  indeed  stretched  paper  thin. 

The  Laboratopt.Division’s  CART  team  supports  the  investigation  of  any  sort  of  criminal 
investigation  m which  evidence  might  be  found  on  a computer  (such  as  a drug  trafficker’s 
accounts)  by  conducting  computer  forensic  examinations  on  seized  media.  The  Lab’s  technically 
trained  agents  develop,  deploy,  and  support  equipment  to  perform  Title  HI  and  FISA  intercenfio-s 
of  data  communications  on  the  Internet  Staff  in  both  of  these  areas  (forensics  and  engineering  " 
support)  is  extremely  stretched  because  these  agents  are  tasked  with  providing  support  not  oHy 

for  cyber  crimes,  hut  all  traditional  crimes  in  which  digital  evidence  may  he  pmseot  or  data 
interception  required. 

The  FBI's  CART  program,  consisting  of  agents  and  analysts  who  examine  digital  media! 
m order  to  gather  evidence,  is  not  able  to  keep  up  with  the  increasing  workload.  The  following  is 
a summary  of  current  and  future  trends  assuming  that  the  FBI  Laboratory  is  funded  for  all 
pending  budget  requests; 

CART  Capacity  and  Backlog 


Year 

* 

FTB  Staffing 

Capacity 

Exam  Requests  • Case  Backlog 

Backlog 

* 

Time 

* 

(Months) 

1999 

95 

1900 

3500  1600 

10,1 

2000 

104 

2080 . 

5000  2920  - 

16.8 

2001 

.....  154 

3080 

6000  2920. 

11.4  ■ 

2002 

213 

4260 

8500  4240 

11.9 
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In  addition,  the  FBFs  Laboratory  Division  currently  provides  support  not  only  for  FBI 

cases,  but  also  for  the  Drug  Enforcement  Administration  and  the  Immigration  and  Naturalization 
Service. 

_ The  MXPC  and  the  field  office  NIPCIP  squads  are  responsible  for  conducting 
investigations  of  cyber  attacks,  including  computer  intrusions,  viruses,  and  denials  of  service. 

The  NIPC  currently  has  193  FBI  Special  Agents  xn  the  field  offices  investigating  approximately 
1 200  computer  intrusion  and  other  <SNIPCIP”  cases.  Only  16  Field  Offices  have  full  squads  of 
seven  or  more  agents.  The  other  field  offices  have  only  1 to  5 agents,  who  are  responsible  for  not 

only  cyber  investigations,  but  also  for  industry  liaison,  the  InfiaGard  Initiative,  the  Key  Asset 

Initiative,  and  support  to  other  investigative  programs.  Further,  the  NIPC  lacks  sufficient 
computer  scientists  and  analysts  to  support  the  field  office  investigations.  For  instance,  it  has 
only  7 network  analysts/electrical  engineers  to  support  investigations  such  as  DDOS  attacks. 

The  MFC’s  and  Field  Office  resources  have  remained  relatively  static.  The  NIPC 
Headquarters  budget  for  fiscal  years  99-01  has  been  as  follows: 


Fiscal  Year 

1999 

2000 


29,057,000  (included  one-year  funding  of  $1 0 
million  for  special  contingencies  in  Attorney 
General’s  Counter-terrorism  Fund) 


19,855,000 


2001  requested 


20,396,000 


Meanwhile,  our  pending  case  load  has  grown  rapidly. 


Fiscal  Year 
1998 


1999 


801 


2000  (as  of  May  1) 


1072 


Clearly,  then,  resources  have  not  kept  pace  with  the  crime  problem. 

•'  '■ ' b ■■  . ..  ..  J “ 

Evidence  gaithmrig  for  wxmputer  intrusions  mandates  a prompt  response  because  the 
digital  evidence  trail  can  disappear  so  quickly.  The  complexity  of  documenting,  examining  and 
analyzing  the  tremendous  amount  of  information  that  is  necessarily  collected  in  these  types  of 
eases  and  its  very  technical  nature  requires  investigators,  examiners,  and  analysts  with  extremely 
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specific  skills  and  experience.  Because  of  the  technical  nature  of  this  crime,  it  is  difficult,  if  not 
impossible,  to  temporarily  assign  additional  Special  Agents  to  an  investigation  since  a special 
technical  skill  set  is  required  to  investigate  such  matters. 

Staff  shortages  impede  not  only  our  ability  to  conduct  investigations  adequately,  but  also 
to  quickly  obtain  information,  conduct  analyses,  and  craft  and  issue  appropriate  warnings  and 
alerts.  This  makes  the  Indications  and  Warning  mission  much  more  difficult  to  perform. 

4.  Some  have  argoed  that  the  high-profile  February’  attacks  on  Yahoo,  eBay,  and 
other  companies  were  just  a diversion,  allowing  the  hackers  to  focus  on  making  smaller, 
intrusive  attacks  on  smaller  sites. 

Have  you  found  any  evidence  for  this  contention? 

No.  There  are  individuals  and  groups  who  do  focus  on  planning  and  executing  more 
intrusive  attacks,  often  for  the  sake  of  stealing  information  or  money,  but  we  have  not  seen  any 
correlation  between  such  intrusions  and  the  February  DDOS  attacks, 

S,  Why  don’t  you  think  industry  can  solve  this  problem  itself? 


The  Internet  was  not  designed  with  security  as  the  foremost  consideration.  Moreover, 
until  very  recently,  security  was  not  a major  priority  of  either  hardware/sofhvare  manufacturers  or 
consumers.  As  a result,  networks  are  still  rife  with  vulnerabilities.  Improving  security  on  die 
Internet  is  thus  first  and  foremost  the  responsibility  of  industry.  Government  must  protect  its  own 
systems,  and  can  assist  industry  by  providing  information  about  threats  and  vulnerabilities  that  we 
are  aware  of,  and  the  NIPC  does  that.  But  it  is  industry's  responsibility  to  secure  privately  owned 
systems. 


Even  if  systems  were  more  secure,  however,  there  would  inevitably  be  some  amount  of 
computer  crime  committed  on  the  Internet  ~ including  not  just  intrusions,  denials  of  service,  and 
viruses,  but  also  traditional  crimes  perpetrated  over  the  Internet  such  as  fraud  and  dissemination 
of  child  pornography  . As  long  as  crime  exists,  the  public  will  expect  law  enforcement  to 
investigate  and  apprehend  file  perpetrators.  And  effective  law  enforcement  is  a key  element  in 
any  strategy  to  deter  further  criminal  activity.  Thus,  industry  and  law  enforcement  must  work 
closely  together. 


6a.  How  big  a problem  is  Hits  for  the  FBI?  Bo  you  believe  that  there  are  iraportant  cyber 
attacks  that  are  never  investigated  by  law  enforcement  because  the  attacked  companies 
refuse  to  report  them?  • ..  . < 

The  vulnerabilities  that  permeate  the  industry  are  a big  problem  for  the  FBI  and  other  law 
enforcement  agencies  because  they  make  it  so  easy  for  crimes  to  be  committed.  This  accounts  in 
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1.  Of  the  800  cases  referred  for  criminal  investigation  to  FY 1999  from  the  NIPC,  what 
percentage  of  these  cases  were  referred  to  other  agencies,  other  than  the  FBI,  for  continued 
investigation  and  possible  criminal  prosecution? 

As  a general  matter,  the  NIPC  does  not  "refer"  cases.  Cases  are  normally  initiated  by  a 
held  office,  whether  a Field  Office  of  the  FBI,  die  Secant  Service,  another  federal  agency,  or  a 
state  or  local  law  enforcement  agency.  NIPC  is  the  "program  manager"  of  the  FBI’s  compu  ter 
intrusion  Investigative  program,  and  so  receives  information  about  cases  directly  from  fee  FBI 
Field  Offices.  Under  FDD  63,  other  agencies  are  also  supposed  to  report  information  about  cyber 
incidents  to  fee  NIPC  Sometimes,  NIPC  will  receive  fee  first  report  of  a cyber  incident  from  a 
private  company,  a government  agency,  or  another  source,  and  contact  the  appropriate  FBI  Field 
Office.  If  another  agency  has  concurrent  investigative  jurisdiction  or  some  other  non- 
mvestigative  interest,  feat  agency  will  also  be  contacted  (either  by  fee  FBI  Field  Office  of  the 
NIPC).  Where  joint  jurisdiction  exists,  the  FBI  field  office  may  work  jointly  with  fee  relevant 
other  agencies  (as  discussed  further  below). 

i*  * V 

If  an  inquiry  determines  the  complaint  does  not  fall  within  the  investigative  guidelines  of 
fee  FBI,  it  may  be  referred  by  the  field  office  to  another  federal  agency  or  to  a state  or  local  law 
enforcement  agency  which  has  fee  authority  to  conduct  such  investigations.  FBI  field  offices 
develop  liaison  contacts  with  federal,  state  and  local  agencies  investigating  similar  violations 
under  federal  or  state  statutes  and  complaints  are  disseminated  through  these  liaison  contacts. 
There  is  no  system  established  to  track  how  many  complaints  have  been  sent  from  FBI  field 
offices  to  other  law  enforcement  agencies. 

There  have  been,  however,  several  instances  in  which  fee  MFC  or  an  FBI  field  office  has 
contacted  another  agency  to  determine  if  feat  agency  wanted  to  conduct  an  investigation  either 
jointly  or  separately,  but  feat  agency  declined.  A couple  of  examples  are  listed  below. 

In  May  2000,  fee  FBI's  Detroit  Field  Office  referred  a complaint  to  the  local  Secret 
Service  office  regarding  a denial  of  service  attack  against  NHL.com,  going  so  far  as  to  transfer  fee 
call  from  the  FBI  field  office  to  the  Secret  Service  field  office.  The  Secret  Service  told  the 
complainant  feat  no  one  vras  in  fee  office  to  receive  the  complaint  due  to  a visit  of  Texas 
Governor  George  W,  Bush  to  Michigan.  The  complainant  then  called  fee  FBI  again  and  fee 
Detroit  Field  Office  took  the  complaint  and  assigned  fee  matter  for  investigation. 

Also  in  May  2000,  based  on  FBI  source  information,  fee  NIPC  notified  fee  USSS 
headquarters  feat  there  may  be  a vulnerability  wife  the  White  House  Webpage  feat  gave  the 
public  access  to  all  fee  files  on  feat  server.  The  USSS  advised  feat  fee  system  administrator  may 
already  be  aware  of  this.  Neither  the  NIPC  nor  the  FBI’s  Washington  Field  Office  has  heard  back 
from  fee  USSS  regarding  this  matter. 
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In  another  instance,  the  FBI’s  Williamsport,  Resident  Agency,  part  of  the  Phi  ladelphia 
Field  Office,  opened  an  investigation  into  a series  of  computer  intrusion  into  10  companies 
resulting  in  the  loss  of  approximately  28,000  credit  card  numbers.  During  the  initial 
investigation,  the  FBI  discovered  that  one  of  the  victims  located  in  Buffalo,  NY,  had  contacted  the 
Secret  Service  and  the  USSS  had  opened  a case  pertaining  to  the  intrusion  against  the  single 
victim  company,  but  was  not  investigating  the  larger  set  of  thefts.  The  FBI  contacted  the  Secret 
Service  Division  in  Buffalo,  NY  to  coordinate  the  ease,  since  USSS  already  had  a pending 
investigation.  The  FBI  was  told  that  due  to  the  Security  Detail  Duties  for  the  First  Lady,  the 
USSS  would  be  unable  to  coordinate  at  die  present  time  with  the  FBI  on  the  case. 

In  addition,  the  FBI  has  worked,  and  continues  to  work,  many  investigations  jointly  with 
other  agencies.  Two  notable  examples  include  Solar  Sunrise  and  Moonlight  Maze.  Both  cases 
involved  extensive  intrusions  into  Department  of  Defense  and  other  government  agency  computer 
networks.  The  investigations  involved  an  NlPC-coordin&ted  investigation  involving  numerous 
law  enforcement,  intelligence,  and  defense  agencies,  as  well  as  foreign  law  enforcement  agencies. 

Beyond  those  examples,  the  following  are  other  instances  of  joint  investigations. 

DDOS:  Numerous  Internet  commerce  sites  have  been  victimized  by  DDOS  attacks  since 
February  7, 2000.  These  DDOS  attacks  prevented  the  victims  from  offering  their  web  sendees  on 
the  Internet  to  legitimate  users.  A DDOS  attack  uses  compromised  computer  networks  to  "flood” 
a victim  s computer  network  with  massive  amounts  of  data,  which  causes  the  victim's  computer 
network  to  become  overwhelmed  and  to  stop  operating.  The  DDOS  attack  investigation  are 
investigations  in  seven  FBI  field  offices,  five  overseas  Legal  Attache  offices,  oilier  government 
agencies  such  as  NASA,  as  well  as  the  Royal  Canadian  Mounted  Police!  Reflecting  the 
extraordinary  level  of  cooperation  on  these  investigations,  on  April  15, 2000,  the  Canadian 
officials  arrested  a juvenile  charging  him  with  one  of  the  attacks. 

Cpradpri  On  March  1, 2000,  a computer  hacker  using  the  name,  "Curador”,  allegedly 
compromised  multiple  E-commerce  websites  in  the  U.S.,  Canada,  Thailand,  Japan  and  the  United 
Kingdom,  and  apparently  stole  as  many  as  28,000  credit  card  numbers.  Thousands  of  credit  card 
numbers  and  expiration  dates  were  posted  to  various  Internet  websites.  On  March  9, 2000, 
IntemetNews  reported  that  Curador  stated,  "Law  enforcement  couldn't  hack  their  way  out  of  a wet 
paper  bag.  They're  people  who  get  paid  to  do  nothing.  They  never  actually  catch  anybody."  After 
an  extensive  international  investigation,  on  March  23, 2000,  the  FBI  assisted  the  Dyfed  Powys 
(UK)  Police  Service  in  a search  at  the  residence  of  Curador;  Curador,  age  18,  was  arrested  in  the 
UK,  along  with  an  apparent  co-conspirator  under  the  Computer  Misuse  Act  1990.  Under  United 
Kingdom  law,  both  males  have  been  dealt  with  as  adults.  Loss  estimates  are  still  being 
determined.  • ' TT 

This  case  was  predicated  on  the  investigative  work  by  the  Dyfed  Powys  Police  Service, 
the  Federal  Bureau  of  Investigation,  Internet  security  consultants,  the  Royal  Canadian  Mounted 
Police,  and  the  intemational  banking  and  credit  card  industry.  This  case  illustrates  the  benefits  of 
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law  enforcement  and  private  industry,  around  the  world,  working  together  in  partnership  on 
computer  crime  investigations.  ' k ‘ 

SmB£»  In  August  1998,  the  FBI  initiated  an  investigation  on  an  individual  only  known  as 
zyklon, 1 who  conducted  numerous  computer  intrusions  to  various  computer  systems  causing 
damages  to  websites  and  system  files.  The  case  was  worked  in  cooperation  with  the  Virginia 
State  Police,  Hie  investigation  identified  zyklon  to  he  Eric  Bums  of  Shoreline,  Washington.  In 
February  1 999,  following  an  execution  of  a search  warrant.  Bums  confessed  to  the  intrusions.  In 
May  1999,  Bums  also  gained  unauthorized  access  and  defaced  the  webpage  for  the  White  House 
website.  At  that  point  the  FBI  began  working  with  the  U.S.  Secret  Service  on  foe  case.  In  ^ 
September  1999,  Bums  pleaded  guilty  to  one  count  for  violation  of  Title  18  USC  Section  103  0 
(Computer  Fraud  and  Abuse)  for  one  of  the  1998  intrusions.  In  the  plea  agreement.  Bums  also 
admitted  his  criminal  activity  into  several  other  intrusions  including  the  White  House  website.  In 
November  1999,  Bums  was  sentenced  to  15  months  in  prison,  3 years  supervised  release  and  * 
$36,240  In  restitution  and  a $ 100  fine. 

Triform  This  investigation  was  worked  jointly  with  the  Middletown  Rhode  Island  Police 
Department,  the.state  Office  of  the  Inspector  General  (OIG),  National  Aeronautics  and  Space 
Administration  (NASA),  and  the  FBI.  Sean  Trifero  compromised  various  company  and 
University  computer  systems,  including  systems  maintained  by  Harvard  University,  Amherst 
College,  Internet  Services  of  Central  Florida,  Aliant  Technologies,  Arctic  Slope  Regional 
Corporation  and  Barrows  Cable  Company.  He  would  utilize  these  compromised  systems  to 
establish  web  pages,  E-Mail  and  In  ternet  Relay  Chat  (IRC)  Groups  in  the  background  of  the 
victim  s computer  system.  Trifero  would  also  provide  others  with  access  to  these  compromised 
systems.  On  1 0/671998,  Trifero  entered  a guilty  plea  in  the  District  of  Rhode  Island,  in 
connection  with  tins  matter.  On  2/22/1999,  Trifero  was  sentenced  in  connection  with  his  guilty 
plea  to  five  counts  of  violating  Title!  S United  States  Code,  Section  1030.  He  was  sentenced  to- 
12  months  plus  1 day  in  jail;  S32, 650.54  in  restitution;  $500  special  assessment;  three  yearn 
supervised  release;  five  hours/wk  community  service  for  36  months;  use  of  the  Internet,  but  no 
contact  with  members  of  any  hackmg/cracking  group. 

Mewhiney:  Throughout  1996,  National  Oceanic  and  Atmospheric  Administration  (NGAA) 
suffered  several  computer  intrusions  which  were  also  linked  to  intrusions  occurring  a the  National 
Aeronautics  and  Space  Administration  (NASA).  These  computer  intrusions  continued  through 
1997.  The  FBI  worked  the  ease  jointly  with  NOAA,  NASA  and  the  Canadian  authorities  and 
identified  fhe  subject,  Jason  G.  Mewhiney,  who  resided  in  Canada,  The  original  damage 
assessment  that  Mewhiney  had  caused,  exceeded  $40,000.  In  April  1999,  Jason  G.  Mewhiney 
was  indicted  by  Canadian  authorities.  InJanuary  2000,  Mewhiney  pleaded  guilty  to  12  counts  of 
intrusions  which  deluded  violations'  spanning  from  May  1996  through  April  1997,  of 
destroyed/altered  data  and  intrusions  with  foe  intent  to  damage.  In  the  Canadian  Superior  Court 
of  Justice,  Mewhiney  was  sentenced  to  6 months  in  jail  for  each  of  foe  counts  to  run  concurrently. 
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BHssJ  la  February,  1998,  the  FBI  opened  an  investigation  to  assist  the  U.S.  Air  Force  and  IIS. 
Navy  regarding  multiple  computer  intrusions.  The  case  was  worked  jointly  with  the  U.S.  Naval 
Criminal  Investigative  Service  and  Florida  State  Attorney's  Office  in  Jacksonville,  FL.  The 
subject  v'as  identified  as  Jesse  Le  Bliss,  a student  of  the  University  of  North  Florida.  On  August 
21, 1998,  Bliss  pleaded  guilty  to  one  felony  count  for  vi  olation  of  Florida  State  Statute  815  .06 
entitled,  Offices  Against  Computer  Users.  On  September  19, 1998,  Bliss  was  sentenced  in  the 
Fourth  Judicial  Circuit,  State  of  Florida,  to  six  months  house  arrest  followed  by  three  years 
probation,  200  hours  of  community  service,  and  a written  letter  of  apology  to  the  Commandant  of 
the  United  States  Marine  Corps. 

CP.UMysrse:  One  pending  case  being  worked  by  the  FBI’s  New  Haven  Division  and  the  U.S. 
Secret  Service  has  been  widely  reported  in  the  press,  due  to  statements  made  to  reporters  by  the 
alleged  perpetrator.  Jh  December  1999,  the  FBI’s  New  Haven.  Division  opened  a case  into 
intrusions  into  the  computers  of  CD  Universe,  an  on-line  music  seller,  and  the  theft  of  customers’ 
credit  card  numbers  and  a related  extortion  threat.  Because  of  tire  credit  card  aspect,  the  FBI 
called  the  USSS  to  ask  if  USSS  wanted  to  investigate  jointly.  The  USSS  declined.  In  January 
2000,  the  New  T ork  Times  ran  a front  page  story  about  the  case,  based  on  conversations  between 
the  reporter  and  the  alleged  perpetrator.  Subsequently,  USSS  called  the  FBI  back  and  requested 
to  work  the  case  jointly.  That  case  is  still  pending. 

Other 


There  are  other  investigations  that  are  being  conducted  with  other  agencies,  however 
further  details  may  adversely  impact  the  investigation  due  to  their  pending  status.  There  are 
currently  47  pending  investigative  cases  which  are  being  worked  jointly  between  the  FBI  and  the 
multiple  entities  of  the  Department  of  Defense.  An  additional  58  cases  were  investigated  jointly 
with  other  entities  that  are  now  in  closed  status. 

2.  If  some  of  the  referred  cases  are  potential  violations  that  are  traditionally  enforced  and 
investigated  by  other  agencies,  please  describe  your  mechanisms  and  procedures  that  allow 
for  cyber  investigations  to  be  conducted  by  those  particular  law  enforcement  agencies  (other 
than  the  FBI). 

The  primaty  statute  used  by  the  FBI  in  computer  intrusion  investigations  is  Title  18,  USC, 
1 030.  Under  this  statute,  the  FBI  has  broad  authority  to  investigate  computer  crime  offenses.  In* 
instances  where  the  computer  crime  does  not  meet  FBI  jurisdiction,  the  local  FBI  field  office  will 
refer  the  complainant  to  the  appropriate  law  enforcement  agency  (federal,  state,  or  local)  which 
has  authority  to  conduct  the  investigation.  On  other  occasions,  the  FBI  may  continue  to  work  a 
matter  jointly  with  another  law  enforcement  agency,  even  if  they  do  not  Imve  primary  jurisdiction, 
to  provide  needed  resources  and  technical  expertise.'  FBI  field  offices  develop  liaison  contacts 
with  state  and  local  agencies  investigating  similar  violations  under  state  statutes  and  complaints 
are  disseminated  through  these  liaison  contacts.  The  above  cited  credit  card  case  is  an  example  of 
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how  the  FBI  field  offices  make  direct  contact  with  their  counterpart  field  offices,  such  as  US 
Secret  Service,  to  coordinate  aspects  of  an  investigation. 

3.  Please  specifically  cite  the  number  of  MFC  referred  cases  that  have  a direct  impact  or 
posed  a threat  on  file  nation's  critical  infrastructures. 

The  nation’s  “critical  mfrastmctures”  are  those  physical  and  cyber-based  systems  essential 
to  the  minimum  operations  of  the  economy  and  government,  including  telecommunications, 
energy^,  banking  and  finance,  transportation,  water  systems  and  emergency  sendees,  both 
governmental  and  private.  One  of  the  most  difficult  aspects  of  cyber  investigations  is  that  it  is  not 
clear  at  the  outset  what  the  extent  of  the  threat,  or  tire  potential  damage  to  networks,  is.  Each  case 
must  be  thoroughly  investigated  to  determine  the  level  of  threat  and  compromise.  What  seems 
like  a relatively  minor  incident  might  turn  out  to  be  very  significant,  and  vice  versa.  This  means 
that  it  is  much  more  difficult  for  field  investigators  to  use  traditional  investigative  thresholds  in 
determining  how  to  utilize  scarce  resources.  Moreover,  computer  systems  and  networks  employ 
tnpted  relationships  between  other  computer  system  and  networks,  based  upon  the  users' 
privileges.  If  a computer  system  or  network  is  root-level  (or  super  user)  access  compromi  sed,  the 
threat  potential  is  substantial,  and  could  theoretically  pose  a major  threat  to  other  trusted  systems. 
This  means  that  “critical  infrastructure”  systems  are  often  connected  with,  and  affected  by, 
systems  that  arc  in  and  of  themselves  not  critical. 

The  existing  NIPC  database  does  not  classify  cases  by  critical  infrastructure  at  this  time. 
Thus,  there  is  no  methodology  to  determine  which  cases  ultimately  involve  a threat  to  our  nation's 
critical  infrastructure. 


The  Distributed  Denial  of  Service  (DDOS)  attacks  launched  in  February  of  this  year  are  a 
good  example  of  tire  difficulty'  of  cat  egorizing  an  attack  as  an  “infrastructure”  attack  or  some 
lesser  sort  of  attack.  In  a Distributed  Denial  of  Services  attack,  not  only  are  the  "victim"  systems 
affected,  but  also  the  thousands  of  computer  systems  and  networks  that  were,  unknowingly, 
infiltrated  and  used  to  carry  out  the  attack,  and  Internet  Sendee  Providers  that  were  heavily 
trafficked  during  the  attack.  All  of  the  computer  systems  and  networks  that  participated  in  the 
attack  were  compromised.  Moreover,  even  though  the  effect  of  the  attacks  was  relatively 
ephemeral  and  brief,  the  knowledge  gained  by  analyses  of  these  attacks  is  critical  to  our  abilitv  to 
protect  against  more  devastating  attacks  in  the  future.  If  the  DDOS  attacks  had  been  directed  ' 
against  the  major  Internet  hubs  rather  than  against  primarily  e-commerce  companies,  traffic  on  the 
Interne  t could  have  been  paralyzed,  disrupting  several  of  the  critical  infrastructures  that  rely  on 
the  Internet  for  communication. 

4.  Please  describe  the  job  description  and  agen  cy  of  any  state  and  local  law  enfo  rcement 
officials  currently  assigned  to  NIPC  on  a full  time  basis  at  FBI  Headquarters.  - 

The  FBI  currently  has  one  local  law  enforcement  officer  assigned  to  the  NIPC.  He  is  from 
the  Tuscaloosa  County  Sheriffs  Department  and  his  principal  job  is  to  work  on  outreach  initiatives 
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to  state  and  local  law  enforcement  as  part  of  the  FBFs  responsibility  as  the  “Lead  Agency”  to 
work  with  the  ‘‘Emergency  Law  Enforcement  Sendees  Sector”  under  FDD-63.  He  has  also 
participated  in  the  delivery  of  training  to  field  investigators  under  our  Key  Asset  Initiative.  This 
representative  replaced  an  earlier  representative  from  the  Oregon  State  Police,  who  rotated  back  to 
Ms  home  agency.  The  NIPC  is  also  in  discussions  with  several  Washington,  DC.  area  police 
departments  about  having  officers  detailed  to  the  NIPC  on  a full-  or  part-time  basis. 

5.  Please  describe  any  private  sector  representatives,  past  or  present,  who  voluntarily 
participate  in  the  Center  to  facilitate  sharing  of  information  between  NIPC  and  the  private 
infrastructure  owners  and  operators. 

The  NIPC  works  on  a daily  basis  with  private  sector  representati  ves  to  share  information. 
This  occurs  through  such  initiatives  as  InfiaGard,  which  provides  information  to  infrastructure 
owners  and  operators  on  a daily  basis,  and  the  pilot  project  for  Indications  and  Warning  that  the 
NIPC  has  established  with  the  electrical  power  sector  under  the  auspices  of  NERO,  and  the  Key 
Asset  Initiative.  It  also  occurs  on  a case  by  case  basi  s as  we  disseminate  targeted  or  general  alerts 
or  warnings  to  industry.  The  NIPC  also  works  closely  with  private  sector  contractors  who  assist 
with  technical  analysis  and  information  sharing. 

In  addition,  the  NIPC  is  working  with  the  Information  Technology  Association  of 
America  to  bring  private  sector  representatives  into  the  Center  for  a period  of  time  as  “detailees.” 
That  is  part  of  a cybetcrime  initiative  sponsored  by  the  ITAA  and  the  Attorney  General. 

6.  Please  describe  any  private  sector  representatives  that  are  hired  and  paid  by  NIPC  funds. 

The  NIPC  has  hired  contractors  to  support  our  work  in  analyzing  cyber  intrusions  into  the 
infrastructures  as  well  as  to  provide  technical  support  to  our  investigations.  In  addition,  a 
representative  from  Sandia  National  Laboratories,  has  been  working  at  the  Center.  The  NIPC  has 
been  reimbursing  the  Department  of  Energy  under  the  Interagency  Personnel  Act  for  the  cost  of 
this  detallee’s  contract. 

7.  On  page  lb  of  your  written  testimony,  you  state:  "the  FBI,  on  behalf  of  the  law 
enforcement  community  should  enhance  its  technical  capabilities  (encrypted  evidence)," 
Shouldn't  all  law  enforcement  agencies,  from  federal  to  state  require  this  capability  to 
accomplish  the  NIPC  mission  ? 

■* 

As  noted  on  page  16  of  the  written  testimony,  the  law  enforcement  community  is 
extremely  consumed  about  the  serious  public  safety  threat  posed  by  the  proliferation  and  use  of 
strong,  commrarially-availahle  encryption  products  that  do  not  allow  for  law  enforcement  access 
to  the  plaintext  of  encrypted,  criminally-related  evidence  obtained  through  court-authorized 
electronic  surveillance  and/or  search  and  seizure.  The  potential  use  of  such  non-xeeoverable 
encryption  products  by  a vast  array  of  criminals  and  terrorists  to  conceal  their  criminally-related 
communications  and/or  electronically  stored  mformation  poses  an  extremely  serious  threat  to 
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public  safety  and  national  security. 

In  order  to  address  this  serious  threat  and  as  noted  in  the  written  testimony,  it  is  imperative 
that  law  enforcement  enhance  it  technical  capabilities  in  the  area  of  plaintext  access  to  encrypted 
evidence.  As  j>art  of  the  government’s  approach  to  the  encryption  issue,  the  Administration  has 
expressed  support  for  and  has  proposed  the  creation  of  a law  enforcement  Technical  Support 
Center  within  foe  FBI  for  the  purpose  of  providing  foe  entire  law  enforcement  community  with 
urgently  needed  plaintext  access  technical  capabilities  necessary  to  fulfill  its  investigative 
responsibilities  in  light  of  the  proliferation  of  strong,  commercially-available  encryption  products 
within  foe  U.S,  In  fact,  included  in  fee  Administration's  Cyberspace  Electronic  Security  Act  of 
1 999  which  was  forwarded  to  foe  Congress  last  September  is  a provision  that  authorizes- to  be 
appropriated  $80  million  to  foe  FBI  for  foe  creation  of  foe  Technical  Support  Center,  whi  ch  will 
serve  as  a centralized  technical  resource  for  federal,  state  and  local  law  enforcement  in  responding 
to  the  ever  increasing  use  of  encryption  by  subjects  of  criminal  cases. 

The  TSC  is  envisioned  as  an  expansion  of  foe  FBI’s  Engineering  Research  Facility  (ERF) 
to  take  advantage  of  ERF's  existing  institutional  and  technical  expertise  in  this  area.  This 
approach  represents -a -cost  effective,  non-duplicative  and  efficient  means  of  provide  every  U.S. 
law  enforcement  agency  with  access  to  technical  capabilities  needed  to  address  lawfully  seized 
encrypted  evidence  and  is  supported  by  the  International  Association  of  Chiefs  of  Police,  the 
National  Sheriffs  Association  and  the  National  District  Attorney  Association  as  well  as  the 
Information  technology  industry'. 


8.  Please  describe  which  agencies  were  in  the  past  participating  in  the  NIPC,  but  are  no 
longer  members.  Describe  the  reasons  given  by  those  agencies  to  the  FBI  for  their 
withdrawal  from  participation. 


One  of  the  difficulties  in  attempting  to  operate  an  interagency  Center  is  ensuring  that  all 
relevant  agencies  participate.  Agencies  have  not  received  direct  funding  to  participate  in  foe 
Center,  and  so  must  take  defailees  to  foe  NIPC  out  of  existing  personnel  resources.  In  addition, 
personnel  with  cyber  expertise  are  unfortunately  in  very'  short  supply,  meaning  that  agencies  must 
commit  to  take  scarce  resources  and  send  them  outside  their  agencies.  Despite  these 
impediments,  numerous  agencies  have  sent  detailees  to  the  NIPC,  Including:  Defense/Office  of 
..  foe  Secretary  of  Defense;  Central  Intelligence  Agency,  National  Security  Agency;  Air  Force 
Office  of  Special  Investigations;  U.S.  Navy;  U.S.  Army;  U.S.  Postal  Service;  Defense  Criminal 
Investigative  Service;  General  Services  Administration;  U.S,  Air  Intelligence  Agency; 
Department  of  Commerce,  and  foe  Tuscaloosa,  AL  Sheriffs  office.  In  addition,  we  have  foreign 
liaison  representatives  from  two  allied  countries  who  assist  in  coordinating  international  activities 
wifo  our  cotmtetpam.  A representative  torn  FAA  is  also  scheduled  to  start  at  foe  end  of  June. 
Additional  repressmtefive  front  DoD,  CIA,  and  NSA  are  also  slated  to  arrive  in  foe  near  future. 

We  are  also  expecting  representatives  from  local  Washington  area  police  departments  on  a part- 
time  basis. 
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Some  agencies  were  represented  earlier  but  do  not  currently  have  representatives. 
Circumstances  necessitated  the  recall  of  the  first  State  Department  representative.  State  agreed  to 
do  so,  and  has  committed  to  NIPC  that  it  would  replace  him  with  two  new'  representatives,  DoE’s 
first  representative  rotated  hack  after  more  than  two  years.  NIPC’s  understanding  as  to  whv  this 
representative  rotated  bade  is  that  he  was  at  NIPC  for  a lengthy  time  and  was  needed  at  DoE 
headquarters  to  assist  m a DOE  reorganization.  DoE  has  committed  to  replacing  that  detailee. 

Secret  Service  earlier  had  two  detailees  to  the  NIPC,  but  recalled  those  detailees  and  has 
not  yet  committed  to  replacing  them.  Secret  Service  has  not  provided  any  written  explanation  for 
tins,  but  in  oral  discussions,  Secret  Service  officials  stated  that  USSS  was  not  getting  additional 
funding  for  its  electronic  crimes  program  despite  its  participation  in  NIPC;  the  FBI  was  receiving 
more  media  attention  in  the  cyber  crime  area;  and  NIPC  had  not  “referred”  cases  to  Secret  Service 
for  investigation.  NIPC  offered  any  support  it  could  give  to  Secret  Service  in  addressing  budget 
requests;  noted  that  NIPC  public  statements  often  referred  to  partnership  with  USSS*  and  offered 
to  do  more-  to  support  USSS  initiatives  with  public  statements  and  case  analyses.  NIPC  also 
stated  (as  discussed  further  below)  that  its  role  is  not  to  create  and  “refer"  cases*  rather  eases 
generally  originate  in  Field  Offices,  and  FBI  and  Secret  Service  field  offices  frequently  work 
computer  crime  cases  together. 

NIPC  fully  recognizes  the  value  other  agencies  bring  to  the  cyber  crime  and  infrastructure 
protection  mission.  That  is  why  NIPC  is  an  interagency  Center,  and  has  senior  managers  from 
other  agencies  in  addition  to  investigators  and  analysts.  For  instance,  the  NIPC  Deputy  Director 
is  from  DoD/OSD;  the  Section  Chief  of  the  Analysis  and  Warning  Section  Is  from  CIA;  the 
Assistant  Secti  on  Chief  of  the  Computer  Investigations  and  Operations  S ection  is  from  Air  Force 
OSI;  the  Unit  Chief  of  the  Analysis  and  Information  Sharing  Unit  is  from  NS  A;  and  the  Unit 
Chief  of  the  Watch  and  Warning  Unit  is  from  the  U.S.  Navy.  Secret  Sendee  formally  occupied 
the  position  of  Assistant  Section  Chief  of  the  Training,  Outreach,  and  Strategy  Section, 

Recognition  of  the  need  for  other  agency  participation  is  also  what  drives  NIPC  to  continually 
seek  additional  representatives  from  offer  agencies.  It  Is  also  reflected  in  the  numerous  joint 
investigations  ff  at  NIPC  and  FBI  Field  Offices  have  been  involved  in  with  off  er  agencies  (as 
discussed  further  below'),  v 


Senator  Leahv: 

1.  Can  an  attempt  to  commit  a violation  of  18  U.S.C.  § 1030  (a)(5)  currently  be  prosecuted 
under  the  attempt  provision  found  In  18  U.S.  C.  § 1030(b),  even  if  the  attempt  does  not 
result  in  loss  of  at  least  $5,000  or  cause  one  of  the  other  results  listed  in  § 1030  (e)(8)? 

_ ’^ie  question  calls  for  an  answer  interpreting  prosecution  authority  under  statute,  and  as 
such,  is  more  appropriately  propounded  to  the  Department  of  Justice.  As  a general  rale,  however 
the  FBI  understands  that,  under  certain  factual  circumstances,  18  U.S.C.  § 1030(b)  does  allow  for 
the  prosecution  of  violations  of  18  U.S.C.  § 1030(a)(5)  even  if  the  attempt  does  not  result  in  a loss 
of  at  least  $5,000  where  evidence  demonstrates  the  offender  ’s  specific  intent  was  to  cause  a loss 
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In  excess  of  $5,000. 

2.  If  an  attempt  cannot  be  so  prosecuted,  would  amending  the  statute  so  that  the 
aggravating  factors  included  in  the  definition  of  "damage"  in  18  U.S.C.  SS  1030  (elfSVAV. 

<D)  are  instead  moved  to  be  elements  of  the  offense  under  § 1030  (a)(5)  change  thafreshit? 

T&z  question  calls  for  a hypothetical  interpretation  of  a statutory  amendment  as 
appKed  through  fee  substantive  case  law  of  "attempt,"  and  should  be  directed  to  the  Department  of 
Justice  for  a more  detailed  and  definitive  response.  As  a general  matter,  however,  the  FBI  does 
not  understand  that  elevating  the  definitional  elements  of  the  term  "damage"  to  become 
substantive  elements  of  section  1030  offenses  will,  in  all  circumstances,  resolve  the  attempted 
©tee  issues  generated  by  the  facts  of  most  investigations.  Instead,  the  FBI  favors  an  approach 
which  would  combine  a restructuring  of  the  elements  of  the  definition  of  "damage"  into  the 
penalty  provisions  of  section  1030(c)  with  the  creation  of  a lesser  offense  for  those  circumstances 
where  damages  of  $5,000  or  more  cannot  he  substantiated  The  FBI  believes  that  some 
unauthorized  access  intrusions  into  computers  affecting  interstate  commerce  (Le.,  protected 
computers)  are  so  inherently  violative  as  to  justify  Federal  criminal  sanctions  even  where  there  is 
no  change  affecting  the  integrity  or  availability  of  data  or  where  the  actual  damages  suffered  do 
not  attain  tire  $5,000  threshold.  The  intentional  unauthorized  computer  intrusion  into  the 
privileged  and  private  medical  records  of  citizens  is  but  one  such  example.  Such  a statutory 
approach  as  has  been  suggested  by  DoFs  Computer  Crime  and  Intellectual  Property  Section 
(COPS)  would  create  a lesser  included  misdemeanor  offense  where  the  $5,000  threshold  is  not, 
in  fact,  demonstrated  and  would  provide  jurors  in  cases  involving  damages  close  to  the  threshold 
a legitimate  alternative  for  otherwise  violative  behavior. 

3.  If  a definition  of  "loss"  were  added  to  § 1030(e)  to  define  loss  as  "the  reasonable  cost  to 

any  victim  of  responding  to  the  offense,  conducting  a damage  assessment,  restoring  data, 
programs,  systems  or  information  to  their  condition  prior  to  the  offense  and  any  revenue 
lost  or  costs  incurred  by  the  victim  as  a result  of  interruption  of  sendee,"  would  the  $5,000 
threshold  be  easier  to  meet  than  under  current  law?  ' * * 

The  FBI  favors  any  amendments  which  allow  for  the  increased  inclusion  of  any  costs, 
losses  or  other' expenditures  that  a victim  would  not  have  reasonably  incurred  but  for  the  violation 
regardless  of  whether  those  losses  resulted  from  an  actual  interruption  of  sendee.  The  FBI  favors 
such  a definition  which  would  also  include,  if  reasonable,  the  cost  of  system  reconfigurati  on 
related  to  deterring  or  eliminating  similar  future  violations. 

4.  With  respect  to  violations  of  § 1030(a)(5)(A),  is  it  your  understanding  that  each  separate 
"transmission"  coaid  form  the  basis  of  a separate  count?  Similarly,  with  respect  to 
violations  of  §§  1030(a)(5)(BHQ»  is  it  your  understanding  that  each  separate  "intentional 
access!  1 ” could  form  the  basis  of  a separate  count? 

The  question  calls  for  an  interpretation  of  a statute  applying  the  substantive  case  law  of 


5/24/02  Release  - Page  402 


what  constitutes  "criminal  episode,"  and  related  concepts  of  what  constitutes  appropriate 
joinder,"  or  "severance"  under  the  Federal  Rules  of  Criminal  Procedure  and  should  more 
appropriately  be  directed  to  the  Department  of  Justice  for  a detailed  and  definitive  response  As  a 
general  matter,  however,  the  FBI  understands  that  whether  a single  computer  transmission  of 
malicious  code  under  section  1030(a)(5)  may  form  the  basis  for  a single  count  under  an 
indictment  will,  in  large  measure,  turn  upon  the  unique  facts  of  any  given  investigation.  Whether 
a single  transmission  of  a self-replicating,  self  transmitting  destructive  computer  virus  constitutes 
one  transmission,  and  therefore  one  count,  or  thousands  of  transmissions  intentionally  effectuated 
by  chain  reaction,  and  therefore  thousands  of  counts,  may  turn  upon  an  evaluation  of  numerous 
factors  not  the  least  of  which  would  include  the  object  and  intent  of  the  offender/transmitter,  the 
deap  of  the  code,  the  reasonable  foreseeability  of  re-transmission  and,  as  a practical  matter  the 
abihty  to  track,  gauge  and  prove  the  re-transmission.  Similarly,  whether,  in  a computer  network 
tfeC  repefed  ^“^orized  accessing  of  a computer  in  violation  of  section 
(a)(5)(B)*(C),  which  accessing  is  temporally  related,  will,  as  a practical  matter,  frequently 

turn  upon  the  configurati  on  of  the  network  and  its  security  and  banner  system,  to  name  but  a few 
factors, 

5.  Are  you  aware  of  any  cases  in  which  the  current  statutory'  maximum  terms  of 
imprisonment  under  18  U.S.C.  § 1030  were  insufficient  to  effect  the  sentence  called  for  bv 
the  Sentencing  Guidelines,  including  using  the  provisions  of  U.S.S.G.  § SGI ,2,  which  ' 
provide  that  sentences  on  multiple  counts  may  be  imposed  consecutively'  to  the  extent 

necessary'  to  produce  a combined  sentence  equal  to  the  total  punishment  called  for  by  the 
guidelines? 

The  NIPC  referred  this  question  to  the  Department  of  Justice  Computer  Crimes  and 
In?  I0??31  Pr0perty  Section  for.  *nPut-  The  Department  reported  that  it  could  recall  no  cases  in 

which  the  current  statutory  maximum  terms  of  imprisonment  under  18  U.S.C.  § 1030  were 

insufficient  to  effect  the  sentence  called  for  by  the  Sentencing  Guidelines,  including  using  the 
provisions  of  U.S.S.G.  § 5GL2.  s 

6.  Please  explain  the  reason,  if  any,  to  continue  the  codification  of  the  work-sharing 
~ between  the  Secret  Se™«  the  Federal  Bureau  offavestlgatiou  found  in  § 

, ,?.!?!*  spedficaUy  ^ &e  Secret  Service’s  authority  to  investigate  crimes 

i ° i° tbose  ofFenses  mdtT  subsections  (a)(2)(A)  and  (B),  (a)(3),  (a)(4),  (a)(5) 
and  (a)(6).  The  Senate  Report  accompanying  the  1 996  amendment  explained  that: 

[tjhe  new  crimes  proposed  in  the  bill,  however,  do  not  fall  under  the  Secret 
Service's  traditional  jurisdiction.  Specifically,  proposed  subsection  1030fa¥2VCl 
addresses  gaps  in  18  U.S  .C.  2314  (interstate  traction  of  stolen  ppS 
proposed  section  1030(a)(7)  addresses  gaps  in  18  US.C.  1951  (the  Hobbs  Act)  and 
875  (interstate  threats).  These  statutes  are  within  the  jurisdiction  of  the  Federal 
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Bureau  of  Investigation,  which  should  retain  exclusive  jurisdiction  over  these  types 

of  offenses,  even  when  they  are  committed  by  computer. 

S.  Rep.  No.  357, 104th  Cong.,  2d  Sess.  13  (1996). 

Xi&erent  in  die  1996  changes  was  the  recognition  that  the  statute  was  being  amended  to 
reflec  t the  respective  investigative  jurisdictional  limits  existing  at  that  time.  It  was  clear  at  that 
time  that  the  jurisdiction  of  the  Secret  Service,  found  at  18  U.S.C  § 3056,  did  not  encompass  the 
types  of  offenses  described  m Section  1030  (a)(1),  (a)(2)(C),  or  (a)(7).1  Given  that  there  have 
been  no  additional  grants  of  general  investigative  jurisdiction  to  the  USSS  since  that  amendment, 
it  is  not  clear  why  the  USSS’s  jurisdiction  over  computer  crimes  under  Section  1 030  should  be 
expanded.  The  theft  of  National  Security  information  which  is  the  type  of  information  Section 
1030(a)(1)  was  intended  to  address  has  never  been  the  subj  ect  of  US  SS  jurisdiction.  In  addition 
the  types  of  crimes  contemplated  by  1030(a)(2)(C)  and  (a)(7),  as  recognized  by  the  legisl  ati  ve 
history,  have  traditionally  been  investigations  solely  in  the  province  and  expertise  of  the  FBI. 

The  1996  provision  is  an  explicit  effort  by  Congress  to  address  the  criminal  offenses  at 
issue  through  a division  of  labor  primarily  determined  by  investigative  responsibility  and 
expertise.  Any  reversion  to  the  preU 996 jurisdictional  provisions  raises  serious  issues  and 
concerns  about  the  utilization  of  resources  and  proper  coordination.  Concurrent  jurisdiction 
would  result  in  a duplication  of  efforts  that  would  waste  resources  and  encourage  independent 
investigations  by  separate  agencies  at  the  expense  of  coordinated  joint  efforts.  Indeed,  given  the 
decision  by  Secret  Service  to  refrain  from  participation  in  the  National  Infrastructure  Protection 
Center  (MPC)  (both  by  detailing  personnel  and  providing  investigative  information  from  its 
cases)  despite  a mandate  from  the  President  to  do  so  under  PDD-63,  expanding  USSS’s  cyber 
jurisdiction  at  tins  time  would  result  in  a fractured  approach  to  sensitive  intrusion  investigations 
involving  espionage,  extortion,  and  other  serious  matters.  

7.  The  FBI  has  limited  authority  to  issue  administrative  subpoenas  in  certain  cases,  such  as 
federal  health  care  fraud  or  sexual  exploitation  or  other  abuse  of  children.  Since 
cj  bercrime  cases  are  criminal  in  nature,  is  the  FBI  able  to  obtain  documents  relevant  to  the 
investigation  with  grand  jury  subpoena?  To  the  extent  that  documents  obtained  with  a > 


-1  ’Under  the  direction  of  the  Secretary  of  fee  Treasury,  the  Secret  Service  is  authorized  to  detect  and 
wk>  violates-- 


arrest  any  parson 


P . , . (^i<5a  f*°>S71,t>r  879  *rthis  rifle  or,  with  respect  to  the  Federal  Deposit  Insurance  Corporation, 

--  ^iattous.secrionZn.Zie. 433, 493. 657, 709, 1006, 1007.  1011,  1013, 1014, 

(2)  *ny  of  few*  of  the  United  States  relating  to  coirt$>  obligations,  and  securities  of  United  Km  d ff  * 

••  •;  ?.v,_  ....  ../  , ffiies ma of tofsiga 

. . £>  "*?  0^c  Uw*  ?fthf  Unitcd  Sm«  to  electronic  fund  transfer  frauds,  credit  and  debit  card  frauds,  mi 

A^STS^Se^  the  authority  conferred  by  this  paragraph  shell  be  exercised  t tot  he 

enforcement  agency  with  respect  to  those  laws.  ° - 0 anyo  er  ertUaw 
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grand  Jury  subpoena  need  to  be  shared  with  third-party  experts,  can  permission  be 
obtained  to  do  so  under  Federal  Rule  of  Criminal  Procedure  6(e)(3)? 

Generally  speaking,  a '’governmental  entity"  is  authorized  under  18  U.S.C.  2703  (b)  (1) 
(B)  to  obtain  the  contents  of  an  electronic  communi  cation  in  rewrote  computer  storage  with  prior 
notice,  as  delimited  in  18  U.S.C.  2703(b)  (2),  by  using  an  administrative  or  grand  jury  subpoena. 
A governmental  entity  is  also  authorized  under  18  U.S.C  2703(c)(1)(C)  to  obtain  certain 
subscriber  or  customer  information  horn  a provider  of  electronic  communication  services  or 
remote  computing  service,  by  using  an  administrative,  grand  jury,  or  trial  subpoena,  or  as 
otherwise  permitted  under  IS  U.S.C.  2703  (c)(1)(B),  The  Electronic  Communications  Privacy 
Act  (ECPA)  does  not  itself  identify  which  federal  agencies  qualify  as  "government  entities" 
authorized  to  issue  administrative  subpoenas.  Currently,  the  FBI  is  authorized  to  issue 
administrative  subpoenas  in  cases  involvinghealth  care  fraud  under  18  U.S.C.  §3486  and  in  cases 
involving  child  pornography  and  sexual  solicitation  under  18  U.S.C.  §3486A.  Unfortunately, 
there  does  not  currently  exist  a statute  authorizing  or  designating  the  FBI  as  a "governmental  * 
entity"  authorized  to  issue  administrative  subpoenas  for  violations  of  18  U.S.C.  § 1030  or  other 
crimes  of  fraud  increasingly  committed  by  or  facilitated  through  the  use  of  a computer.  The 
absence  of  such  a statute  impedes  FBI  efforts  to  accelerate  an  effective  response  to  cyber  crime. 

While  helpful,  the  use  of  grand  jury  subpoena  to  acquire  minimally  intrusive  transactional 
information  (e.g.,  so-called  "header  information”  such  as  "to"  or  "from")  or  subscriber  information 
(e.g„  the  name  and  address  of  the  owner  of  an  Internet  screen  name)  is  frequently  a cumbersome 
and  time  consuming  process  especially  in  investigations  where  time  is  of  the  essence  or  where  the 
information  sought  is  from  an  unusually  large  number  o f provid  ers.  Some  circumstances  may 
dictate  seeking  express  court  authorization  under  the  provisions  of  Federal  Rule  of  Criminal  * 
Procedure  6(e)(3)(C)  for  disclosure  to  non-government  experts  who  may  not  qualify  as  personnel 
assisting  the  attorney  for  the  government  in  die  investigation  before  the  grand  jury.  In  many 
cases,  the  practical  concerns  of  delay  and  coordination  with  other  agencies  and  courts  further 
stymies  government’ s ability  to  provide  a timely  response  to  imminent  criminal  behavior. 

The  FBI  supports  an  expansion  of  its  statutory  authority  to  issue  administrative  subpoena 
under  the  Electronic  Communications  Privacy.  Act  for  any  violation  of  law  within  die  FBI’s 
existing  criminal  investigative  jurisdiction.  The  FBI’s  experience  to  date  in  the  issuance  of 
administrative  subpoena  in  the  areas  of  health  care  fraud  and  child  exploitation  crimes 
demonstrates  that  it  can  responsibly  limit  and  control  the  exercise  of  this  authority. 

8.  Denial  of  service  attacks  are  increasing  exponentially.  According  to  the  FBI,  these  attacks 
involve  the  placement  of  tools  such  f asj  Trinoo,  Tribal  Blood  net,  TFN2K  or  Stechenldraht 
on  unwitting  victim  systems,  which  then  send  messages  upou  remote  command  to  a targeted 
computer  system  until  that  system  Is  overwhelmed  and  essentially  shnt(s]  down.  In  order  to 
document  in  real-time  the  remote  command  being  given  and  the  triggering  of  the  message 
flood  to  the  target  system,  is  law  enforcement  currently  required  to  obtain  a wiretap  order 
since  the  unwitting  victim  system  is  not  a "party  to  the  commnnication’,  authorized  to  grant 
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consent  to  electronic  surveillance?  Would  an  exception  to  the  wiretap  law  to  allow  the 
unwitting  victim  system  operator  to  grant  consent  to  electronic  surveillance  be  helpful  to 
law  enforcement? 

Hie  question  calls  for  an  inteiprefation  of  a statute  which  would  more 
appropriately  be  directed  to  the  Department  of  Justice  for  a more  detailed  and  definitive  response. 

As  a genera!  matter,  however,  the  FBI  understands  that;  1)  the  provisions  of  18  U.S.C. 

§251  l(l)(a)  prohibit  all  interceptions  unless  expressly  authorized  elsewhere  in  the  Act;  2)  the 
provisions  of  18  U.S.C.  §251  l(2){a)(i)  authorize  a provider  of  wire  or  electronic  communication 
sendees  to  intercept  communications  on  their  system,  not  because  they  are  parties  to  those 
communications,  but  as  "is  a necessary  incident  to  the  rendition  of  [that]  service  or  to  the 
protection  of  the  rights  or  property  of  the  provider,,,.;"  3)  many  providers  {especially  start-up 
Internet  services)  may  not  have  the  necessary  tools  or  expertise  to  adequately  track,  document  or 
halt  an  intruder  in  their  system  and,  more  perhaps  more  significantly,  no  providers  have 
compulsory  process  to  facilitate  disclosure  of  transaction  and  subscriber  information  from  other 
providers  which  is  necessary  to  identify  the  source  of  an  attack;  4)  18  U.S.C,  §251  l(2)(a)(i)  does 
not  permit  law  enforcement  to  conduct  an  interception  (without  a court  order)  even  upon  a 
provider  s express  request  when  the  provider’s  system  has  been  invaded  or  trespassed  upon  by  a 
hacker,  and  5}  as  a result  of  this  quandary,  and  in  order  to  ensure  that  evidence  obtained  will 
subsequently  be  held  admissible,  law  enforcement  is  required  to  obtain  a court  order  m order  to 
enable  it  to  actively  work  in  conjunction  with  the  provider. 

Given  the  high  level  DOJ  approval  that  is  required  for  Title  in  Interception  applications,  the 
necessary’'  generation  of  paperwork,  and  the  time  needed  by  the  reviewing  court,  significant  delay  can 
occur  before  law  enforcement  can  provide  an  effective  response  to  a hacker  or  DDOS  event.  This 
anomaly  in  the  law  creates  an  untenable  situation  whereby  providers  are  sometimes  forced  to  sit  idly 
by  as  they  witness  hackers  enter  and,  in  some  situations,  destroy  or  damage  their  systems  and 
networks  while  law  enforcement  begins  the  de  tailed  process  of  seeking  court  authorization  to  assist 
them.  In  the  real  world,  the  situation  is  akin  to  a homeowner  being  forced  to  helplessly  watch  a 
burglar  or  vandal  while  police  seek  a search  warrant  to  enter  the  dwelling.  For  these  reasons,  the  FBI 
favors  enactment  of  a statutory  exception  under  18  U.S.C.  §251 1 which  w’ould  expressly  authorize 
law  enforcement  to  assist  such  provi  ders  by  intercepting  the  communications  of  a compu  ter 
user/trespasser  (the  transmissions  to  and  from  the  tiser/trespasser)  BUT  ONLY  upon  the  voluntary, 
written  consent  of  a service  provider  after  that  provider  has  made  an  initial  determination  that  the  ' 
nser/trespasser  is*  & ao*  authorized  to  be  on  the  system  or  network.  Such  an  exception  to  the 

general  interception  prohibition  would  accelerate  exponentially  law  enforcement’s  ability  to  respond 
to  such  hheker  incidents  and  would  be  a significant  step  toward  ensuring  the  security  and  integrity  of 
the  Nation’s  critical  infrastructure. 


/.  Is  law  enforcement  currently  required  to  obtain  a wiretap  in  order  to  document  in  real- 
time the  remote  commands  being  given  to  a target  system? 
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potential  exception  to  this  would  be  certain  pen  register-based  approaches  employed  by  sendee 
providers  in  switch-based  solutions,  where  post-cut-through  dialing  (including  post-cut-  through 
signaling)  may  not  be  provided  to  law  enforcement;  This  circumstance  is  currently  a subject  of 
review  by  the  FCC  under  rule  making  implementing  CALEA,  and  regarding  which  we  anticipate  a 
resolution  in  fee  near  future.)  The  distinction  between  a pen  register  device  on  a telephony  service 
and  a clone  pager  (or  pager  interception)  is  that  a pen  register  is  employed  to  capture  dialed  numbers 
which  are  used  to  set  up  a call.  Hence,  in  the  overwhelming  majority  of  instances  where  pen  registers 
are  used  fee  information  captured  is  simply  signaling  information  used  to  set  up  a call.  By 
comparison,  pager  interceptions  are  employed  to  capture  fee  information  received  by  a pager  which, 
in  all  instances,  constitute  fee  content  or  message  of  the  call  Consequently,  the  law  has  historically 
distinguished  fee  legal  processes  required  for  these  two  types  of  acquisitions  (i.e.,  pen  register 
authority  vs  Title  HI  authority,  respectively). 

Pen  register  efforts  in  fee  data  network  area  work  somewhat  differently.  The  most  basic 
reason  for  tins  is  because  fee  services  (e.g,,  email,  web-based  mail,  voice  over  IP)  and  applications 
(e.g,,  Internet  Chat,  File  Transfer)  transmitted  over  data  networks  are  somewhat  different.  Some  of 
these  services  and  applications  lend  themselves  to  precise  ways  of  capturing  (Le»,  recording)  call 
identifying  and  signaling  information  only  while  others  make  the  process  of  differentiating  signaling 
information  from  call  content  more  difficult  " ~ 

9(B)  Section  3121(c)  of  title  18,  United  States  Code,  requires  government  agencies 
authorized  to  use  pen  registers  to  "use  technology  reasonably  available...that  restricts  the 
recording  or  decoding  of  electronic  or  other  impulses  to  fee  dialing  and  signaling  information 
utilized  in  call  processing.”  Please  describe  the  technolog}'  and  methodology  currentlv 

employed  to  comply  wife  this  statutory  requirement 

Pen  Register  devices  on  telephony  services  continue  to  operate  as  they  have  for  decades 
Stated  differently,  since  the  enactment  of  CALEA  there  has  been  no  change  in  technology  or  pen 
register  equipment  for  telephony  that  would  better  restrict  the  recording  or  decoding  of  electronic  or 
other  impulses  to  the  dialing  and  signaling  information  utilized  in  call  processing. 

As  stated  above,  pen  register  efforts  in  the  data  network  area  work  somewhat  differently,  and 
there,  where  technology  that  restricts  the  recording  or  decoding  of  electronic  or  other  impulses  to  tire 
dialing  and  signaling  information  is  reasonably  available,  it  is  employed.  For  example,  fee  FBI 
employs  pen  register  devices  to  capture  Internet  Protocol  (IP)  addresses.  Since  data  networks 
typically  use  well-established  layered  protocols,  FBI  tools  are  capable  of  restricting  fee  Information 
captured  to  fee  IP  address. 


10.  Section  3121(a)  of  title  18,  United  Sta  tes  Code,  requires  a court  to  authorize  the  u se  of  a 
pen  register  If  the  court  finds  feat  the  government  attorney  has  certified  feat  fee  information 
likely  to  be  obtained  by  "such  use  Is  relevant  to  an  ongoing  criminal  investigation.”  The 
certification  by  fee  government  attorney  is,  in  fern,  made  under  oath  and  penalty  of  perjury. 
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under  section  3122. 


“'I0™"’  rc9“ired  <»  Scribe  (o  (he  coiirt  in  (he  application  for  a pen 
criminal  inv^iioK'' ? m0nCy'S  c'rtitotl»"  «“><  "»■*  “ (e'evanr  (o  an  ongoing 

08)  As  a matter  of  regular  practice,  do  government  attorneys  or  State  law  enforcement  or 
°*!SrrS  appKcad0fl5  for  Pen  describe  for  the  court  the  factual 

doel  this  prlc&e  v^y?1*  ' "**  * ***”“*  *°  3S  °n§oing  criro!nal  investigation’*  or 

(C)  What  procedures,  including  audi(s  or  internal  reviews,  are  in  place  to  ensure  (hat 
government  attorneys  and  State  law  enforcement  or  investigative  officers  compiv  with  the 

?„ “teSfT t ^ !f'C  <b'  fert“a' basis  tot  »dWng  the  application,  particulariv 

mart  « r f*.  r ^r  P™'1"* aM'3'lns  f°r  pen  register  orders  is  not  to  describe  for  the 
court  the  factual  basis  for  certification? 

p)  Should  tb^conrt,  rather  than  governmental  attorneys  or  State  Jaw  enforcement  or 

“ nK gf?f tht  authorit5' t0  raake  the  factaa!  fi»ding  that  '‘information  likely 
to  be  obtained  by  such  installation  and  use  [of  a pen  register]  Is  relevant  to  an  ongoing  criminal 
investigation,"  and  if  not,  please  explain  why?  h 8 

Several  of  the  questions  call  for  or  implicate  an  interpretation  of  statute  which  would  more 
appropriately  be  directed  to  the  Department  of  Justice  for  a more  detailed  and  definitive  response  As 
a general  matter,  however,  the  FBI  understands  the  .Supreme  Court  has  expressly  ruled  that  "the 

0 2 pen  Iesisler  not  a "sesrch"  within  the  meaning  of  the  Fourth  Amendment  and 

themfore  its  use  does  not  violate  the.  Constitution."  .Smith  v.  Maryland.  442 1 T S 735  745-46  99 

contcnf/ f* 2 8h°979)'  ??  * ^ °f  i “ stake  in  the  Snf 

SS  lnfomafion  garnered  through  the  use  of  p en  registers,  the  Courts  ha  ve  held  that  the  l imited 
judical  review  ro  e defeated  by  18  U.S.C.  §3121  etseq,  is  Constitutional  and  is  intended  to 
eguar  against  the  purely  random  use  of  pen  register  devices  by  ensuring  compliance  with  the 

402(im^mO)S  CSt2bhShCd  b>' Congre£S'  See  United  States  v-  Hallmark,  91 1 F.2d  399, 401- 

~ a stf  certifIcations  tby  government  attorneys  are  drafted  and  filed  by  attorney's  of  the 

Department  of  Justice  and  not,  at  the  Federal  level,  by  Special  Agents  of  the  FBI,  Questions 

teg^flteitebstence  ofnnch  crfficatto  would  more  appropriately  directed  to  the  Department  of 
f.  , - f definitive  response.  As  a general  matter,  however,  it  is  the  FBI’s  experience  that 
the  degree  to  which  a pen  register  application  to  the  Court  discloses  the  underlying  factual  basis  for 
the  attorney  s certification  turns,  m large  measure,  upon  the  nature  of  the  statutory  offense  which  is 
&e  focus  of  the  mvesbgation .Whereas  section  3123(b)(1)(D)  requires  that  all  pen  register  orders 

f 0 ofreoss  to  which  the  information  likely  to  be  obtained  by  the  pen  register 

trap  an  ce  device  relates,"  it  follows  that  the  application  required  by  section  3 122(b)(2)  contain 
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f0®^  5 and  it  is  the  FBI’s  experience  that  this  is 

commonly  te  case.  Depending  upon  the  nature  oftheoffense  described  in  the  certificaion  the 
underljang  basts  for  the  certification  can,  and  in  most  instances  will  be  readily  a3“Xfl„ 

« 51? 5 ^ “f  U’e  obvio’K  ia  that  the  ofj-JL  are  £ 

S a 50  S‘mi,ariy  in  nro0,iK  md  to  commit  narcoUc^So^  the 

reliable  and  common  sense  inference  is  dearly  that  telecommunications  are  hd™  ♦ /U?  ’ th 

of  conttolled  subshmces  in  violation  of  Tide  21  of  L 5 

and  Abuse  Act  (18  U.S.C.  §§®030« °f  Computer  Fraud 

underlying  basis  for  the  request,  ^ ^ °r  m,a®nal“  to  m^astand  the 

. . r ' *5  *5°  “fmtods.  ““*<!“  sole  basis  for  obtaining  a pen  register  order  is  to  father  a 
comma]  investigation  by  generating  reliable  admissible  evidence.  An  attorney  who  fabdv  m 

T" P°  18 U'SC  §3122(b®> d« S!> “ hM*r 

peni  subject  to  sanction,  disbarment  and  prosecution.  Furthermore,  an  attorney  who  so  falselv 
eemfies  such  an  application  has  no  way  of  knowing  the  subsequent  coume  and  outcome  oS 
imes  gabion  Frequently,  information  received  from  a pen  register  is  consolidated  with  other 

JS  SUbmlfted  ^ Subs^  »** detailed  apphcatSj tothe  Court  such 
as  search  warrant  applications  or  wiretap  applications.  In  the  unlikely  event  that  an  attomev  for  th* 
government  were  to  submit  a false  certification  to  the  court  in  c„mi  ne  ? K°  ey  for  the 

the  lack  of  any  nexus  between  the  named  subjects  of  the  investor  ti  8 fen  reSlster  application, 

-n  J th,.  ,Hnra ' _w-r  *.  ! ««nwi  BUDjects  01  the  investigation,  the  ‘'statement  of  the  offense  " 

he  attorney  s certification  that  the  information  likely  to  be  obtained  from  the  devise’s  use  is  * 

reel  ant  to  an  ongoing  criminal  investigation  would,  in  many  instances  reveal  itself  either  m 

sr£STh!:;f  forsrh  wras 

prosecution.  ine  dearth  of  such  empirical  or  anecdotal  evident**  J 

certification  of  applicaions  by  attorneys  for 

obligation  is  conscientiously  fulfilled.  certification 

caused  fcmlrtn^r  ^information  theft  and  financial  fraud  perpetrated  online  have 
caused  the  most  severe  financial  losses,  "put  at  $68  million  and  $56  million  respectively  « t„ 

■*»*  ?r  fra"<""™'  1,1 
Tf'1  “7*“**"  ra"°f ,he  1,1  Md  law  enforcement  in  general.:  Appreciating  this 

Tt.  W C0”grBS  bt  rareM  ta  legtsfatlon*,  such  as  H R. 

17M.  The  Electronic  Stgnatnres  Is  Global  and  National  Commerce  Act,"  to  ensure  that 

consumers  are  adequately  protected  in  the  online  environment  This  MB  has  passed  the  House 
ofltepresentatives  and  Is  enrrenfly  the  subject  of  a conference  with  the  Senate 

WneNatit^Wiaon  of  Attorneys  General  has  commented  on  HJR.  1714  staBngthat 

!,’0PS"  otimeaa  'WMely  Sflect" 

°frZ7„'  T W « T ?thTOe  t^air£»  retention  of  original  documents,  "has  the 

»Ttf  s:" “for“mMt  disrov^  °r 


• • f *.\Nr>^v?yev> 
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StvI^l714  W?!d  tbM  State  enactmcnts  of  tfje  mirorm  ®ectnmlc  Transactions  Act 

(UETA)  be  consistent  with  the  House  bill,  resulting  In  federal  preemption  of  any  state 

PreS^Pt;°“  °JVaiidit>'  °f  dectr0nic  signatures  aBd  transactions  that  is  not 
authorized  m the  House  bill.  The  National  Association  of  Attorneys  General  has  opined  that 

this  broad  federal  preemption  would  "unduly  hinder  the  ability  of  the  states  to  protect  thdr 

S C00SUmer  frat,d*"  If  Statcs  ***  hindered  in  combating  consumer  fraud,  would 

the  FBI’s  |ob  in  protecting  the  public  from  fraudulent  online  practices  be  made  more  difficult? 

‘ * ’)  „*'• ' * 

On  its  face,  the  provisions  of  H.R.  1714  which  allow  for  the  electronic  storage  of  contracts 
agreements  and  records  are  unrelated  to  earlier  provisions  of  the  bill  delineating  what  types  ofle^al 
documents  may  be  executed  by  electronic  signature.  To  the  extent  that  Section  101(c)(1)(c)  could  be 
interpreted  as  allowing  for  the  electronic  imaging  and  storage  as  an  electronic  record  of  written 
contracts  or  agreement,  die  tangible  originals  of  which  would  otherwise  be  required  by  law  to  be 
mamtamed  in  tangible  foim,  then,  there  could  exist  the  potential  to  negatively  impact  certain  law 
enforcement investigations  relating  to  such  documents.  At  a minimum,  the  supplanting  of  tangible 
ongmais  (otherwise  legally  required  to  be  maintained  in  tangible  form)  with  electronic  images^ 

°nST  ’ 'I"0  COtl?e4  Wlth  destmction  of  the  would  eliminate  or  complicate 

hm&wn  tt^signa turejxi alysrs  and  render  null  the  possibility  of  recovering  fingerprints  or  other  trace 

ai5I^ace  of  originals.  By  the  same  token,  the  provisions  of  section  1 01  (c)(2)  which 
exempt  from  retention  data  relating  to  the  communication  or  receipt  of  any  contract,  agreement  or 
reeor  e ecfromeally  recorded,  could,  m the  context  of  electronically  executed  contracts,  complicate 
or  eliminate  law  enforcement  efforts  in  tracing  the  source  of  transmission  of  fraudulent  transactions  or 
the  location  and  identity  of  co-conspirators  or  even  other  victims.  The  continued  trend  toward 
electronic,  paper-less  execution  of  commercial  transactions  (which  is  admittedly  so  critical  to  the 
continued  evolution  and  expansion  of  the  Internet)  when  coupled  with  l).the  growing  ability  of 
criminals  to  utilize  encryption  to  restrict  law  enforcement’s  ability  to  recover  crucial  inculpatory 
evidence,  and  2)  the  absence  of  any  preeminent  public  key,  or  private  signature  verification  enfitv  or 

Le  fraud" COmpIiCateS  the  efroits  of  the  FBI  and  state  iaw  enforcement  to  protect  the  public  from  on- 

1.  synopses  only  of  documents  can  negatively  impact  law  enforcement? 

~ . , , , . review  ?fcomP*ete  mA  accurate  records  is  often  necessary  in  law  enforcement’s 
effort  to  help  investigate  cnme.  All  records  management  and  retention  policies  therefore  can  be  said 
to  have -an  effect  on  hw  enforcement,  and  those  policies  which  do  not  require  that  information  be 
mamtamed,  at  least  in  theory-,  can  negati  vely  impact  law  enforcement’s  di  scovery  of  that  information. 

2.  If states  are  hindered * » . 

- ’■  ■■  • ■ . 

}ff,  „ ?!e  f81  believes that  since  States  are  the  primary  responders  to  crime  in  our  country, 

m combatmS  comaker  fraud,  then  the  FBI’s  job  in  protecting  the  public 
from  fraudulent  online  practices  wold  be  made  more  difficult 
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• 9.-7 . 010  Introduction- 

■auSifn  ^n2r  J°nt^ins  department  of  Justice  policy  on  the  use  of  electronic 

? ThL^f?erf-r1leCtroniC  surveillanee  statutes  {commonly  refers* 

vf  lv^y  as  Tatle  1x1  ] are  modified  at  18  U.S.C.  S 2510,  et  sec.  Becai 

- the  weU-recograzed  intrusive  nature  of  many  types  of  electronic  su^veii] 

especially  wiretaps  ana  "bugs,"  and  the  Fourth  Amendment  imp^  cations  S'  * 

government’s  use  of  these  devices  <n  the  course  of  STTIL  ?S  t 

r«,i , S'  , Z j Za  course  o r its  investigations,  the 

' restSctiSrS  'S  re;a-ed  Department  of  Justice  guidelines)  provide 

th\us®  of  most  electronic  surveillance,  includino  the 

of3m?v"5  tw  De',ar"“rt  oMioUl  specifically  ap?rIUe  the  „ 

S*at«ayA^«S»J  oiP*S-0f  eiectron~c  surveillance  prior  to  an  Assistant  Unit 

b ^ing  a C?Urt  orcer  auth°ri2ing  interception. 

7 «<>•* tains  --he  specific  mechanisms,  includina  aopKcab^e  a^^vai 

' for  the  use  Of  wiretaps,  "bugs"  {oral  intent ^ de5?cel) 

'rntintaut -***’■  'V3,aeo  «»«?*illance,  and  the  consensual  monitoring  of  wir*  or#o*> 

a!  weU  as  e®eraency  interception  procedures  and  rest-ict'or 

>he  disclosure  and  evidentiary  use  of  information  obtained  ^rouofSl^!? 
surveillance  RdAi  Hnnai  {m*^**—-*  * . v**v.<s~neu  varougn  electron! 

eiect*onic  ? .COncer‘'llns  uss  Df  the  various  tiroes  of 

^ec^onic  fu^ei^lsnce  is  also  set  forth  in  the  Criminal  Resource  normal 

Attorneys  in  the  Electronic  Surveillance  unit  of  the  OfficI  of  Eneor-^lLf 
Operations,  Criminal  Division,  are  available  to  provide  asI°»?LflT  ? 
both  the  interoretation  of  T-'tip  ttt  am-s  -t-v,®  ■ ® assistance  ccnceinin* 

thereunder.  Interceptions  conduc^ed^Ssuanr  rT+tZ  |rocfss  necessitated 
Surveillance  Act  0/^8?  SSeh'lf  cKif  at  50*1  ITT 

f?f?1:iCally  excl’aded  from  the  coverage  of  Title  lit  %ee  18 '«  I J*  ! q"  ar< 
2511 {2), (a) (ii),  (2){e)y  and  {2} (f) . "6e  18  °'S>C*  § 

9-71  Ola-  , 

U IS..  Attys,  Man.'  9-7.010 
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9-7 . 100 -Authorization  of  Applications  for  Wire,  Oral,  and  Electronic 
Interception  Orders — Overview  and  History  of  Legislation 

To  understand  the.  core  concepts  of  the  legislative  scheme  of  Title  III,  onk 
must  appreciate  the  history  of  this  legislation  and  the  goals  of  Congress  iji 
. enacting  this  comprehensive  law.  By  enacting  Title  III  in  1968,  Congress 
prohibited  private  citizens  from  using  certain  electronic  surveillance 
techniques.  Congress  exempted  law  enforcement  from  this  prohibition,  but 
required  .-compliance  with  explicit  directives  that  controlled  the  circumstan 
under  which  law  enforcement’s  use  of  electronic  surveillance  would  be  permi 
Many  of  the  restrictions  upon  the  use  of  electronic  surveillance  by  law 
enforcement  agents  were  enacted  in  recognition  of  the  strictures  against 
unlawful  searches  and  seizures  contained  in  the  Fourth  Amendment  to  the  Uni 
States  Constitution.  See,  e.g,,  Katz  v.  United  States,  389  U.S.  347  (1967). 
Still,  several  of  Title  Ill’s  provisions  are  more  restrictive  than  what  is 
required  by  the  Fourth  Amendment.  At  the  same  time.  Congress  preempted  Stat 
in- this  area,  and  mandated  that  States  that  sought  to  enact  electronic 
surveillance  laws  would  have  to  make  their  laws  at  least  as  restrictive 
Federal.' law. 

One- of  Title  Ill’s  most  restrictive  provisions  is  the  requirement  that  Fed 
investigative  agencies  submit  requests  for  the  use  of  certain  types  of 
■electronic  surveillance  (primarily  the  hon-consensual  interception  of  wire 
oral  communications)  to  the  Department  of  Justice  for  review  and  approval 
' applications  for  such  interception  may  be  submitted  to  a court  of  competent 
jurisdiction  for  an  order  authorizing  the  interception.  Specifically/  in  18 
U.S.C.  § 2516(1),  Title  III  explicitly  assigns  such  review  and  approval  pow| 
to  the. Attorney  General,  but  allows  the  Attorney  General  to  delegate  this 
and  approval  authority  to  a limited  number  of  high-level  Justice  Departmen 
officials,  including  Deputy  Assistant  Attorneys  General  for  the  Criminal 
Division-  ("DRAGS")',  The  DAAGs  review  and  approve  or  deny  proposed  applicati$: 
to  conduct  "wiretaps”  (to  intercept  wire  [telephone)  communications/  18  U.S 
2510(1))  and  to  install  and  monitor  "bugs”  (the  use  of  microphones  to  inter 
oral  { face-to-face]  communications,  18  U.S.C.  § 2510(2)}.  it  should  be  note$ 
that  only  those  crimes  enumerated  in  18  U.S.C.  § 2516(1}  may  be  investigat 
through  the  interception  of  wire  or  oral  communications.  On  those  rare  occa| 
when  the  government  seeks  to  intercept  oral  or  wire  communications  within 
premises  or  over  a facility  that  cannot  be  identified  with  any  particular 
and.  a "roving"  interception  of  wire  or  oral  communications  is* therefore . bei 
requested,  the  Assistant  Attorney  General  or  the  Acting  Assistant  Attorney 

Copr.  West  2000  No  Claim  to  Orig . U.S.  Govt.  Works 


as 


hi 


rt 


ritf 


5/24/02  Release  - 


ge  ; 
Jbas  < 


es 

ted 


ted 

: la* 
he 
tr&l 


$nd 

fori 


rs 

vie\ 


ns 
C*  i 

kept 


t d 

ion: 


aTOPUTgRCRIHESri  Fax: 20251461 13 


Jul  rm’00  18:33 


U.Si  At'tys.  Man.-  9-7.100  • 

TEXT'  .;  ’ .- 

General  -for  the  .Criminal  Division  roust  be  the  one  to  review  and  approve  or  d 
the  application . (See  the  roving  interception  provision  at  18  O.S*C  § 2518  ( 
discussed  at  USAM  9-7.111.)  ; ' 

In  1986,  Congress  amended  Title  III  bv  enacting  the  Electronic  Comunicatie 
, Privacy  .Act  of  1986.  Specifically,  Congress  added  a new  category  of  covered 
conffimnicatlons,  i.«.,  "electronic  coromunications, * which- would  now  be  protec 
and  whose  interception  would  be  regulated,  by  Title  III.  Electronic  ~ 

communications  are  those  types  of  non-oral  or  wire  communications  that  occur 
'.inter  alia,  over  computers,  digital-display  pagers,  and  facsimile  {"fax«i 
. machines,.-. . See  .18  U.S.C.  § 2510(12). 

.Khj  l$$.§.  amendments  parroit.  any  oovemaent  attorney  to  authorize  tb 

electronic 

^congnuaxgattons  to  investigate  any  Federal  felony  <18  o/SjcTs  2M6(3lT  the 
§SE«SK^t  .M , .^stieTImrc^i^ss^ 

^oactment  approval  would  hdnedhele 

JieJw icstipns  ..could  be  .su^ltteT "to  ~ a~ , 

S32iS5ii.SSSj x .^tJ.?..|hat„£eriod , the„Depa rtroem 

^□S^^rlbnftauid  'thrSid f< 
^Wr£M h.  . to  application  to  the  court  for  the' interception  o) 

.mact,in^s,  Applications  to  the  court  for  authorisation  to  intercept  eUct^onif 
communrcatxons  over  digital-display  pagers-which  are  the  most  commonly  tSg 
type  of  electronic  communications— may  be  made  based  solely  upon  the  9 

authorization  of  a United  States  Attorney.  See  18  O.S.c.  § 25X6(3) . 

unlawful  use  and 
:crTi*iina l7'  civil,  at 
of  evidence,  it  ' is  ' 
agents  clearly  underst 

3Pr^?i^^^rsv3jgwTOd  agBroval  _a.rev  retired; . andlVhaT  such" "a  process 
,entail^wsee  18.  U.S.C.  §§  2511,  2515,  2518 (10) , and  2520’.  * '• 

ee  the  Criminal  Resource  Manual  at  31,.  for  citations  to  relevant  legislatic 
9-7.100  ;\ 

U.'S.  Attys.'Man.  9-7.100 
END. OF  DOCUMENT 
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•..9r7.rllp  Format  for  the  Authorisation  Request 

and  approval  of  a proposed  application  for 
ij^^e^EleM^  of  the 

;-teuJaa.Bj,yl «ian 1 f OKl^sQnfo^^nt  O^eratloM  win'  «n3uct  tt, 
review  of  the  necessary  pleadings , which'' inclu<&7  ® W 

J!,e  sffidavit  of  an  ’’investigative  or  law  enforcement  officer"  of  th<=>  un-t 

Jo?  o4£?  15  eKp0W$red^by  iaw  t0  conduct  investigations  of,  or  to  makeVre 
for,  offenses  enumerated  in  IS  p.s.C.  § 2516(1)  or  (35  (which  for  If 

an?~2??  involving  the  interception  of  electronic  communications,  include 
ny  cederal  felony  offensel,  with  such  affidavit  setting  forth  the  nf 

investigation  that  establish  the  basis  for  those  orobabie  caus*~'"and  othe*T 

■ **««*nts  required  by  Title  III  to  be  included  in  the  application; 

othS\‘£rnefi^by-£n^  ?ni*ed  States  Attorn«y  « his/her  Assistant,  or  ani 
other  avtorney  authorizes  by  raw  to  prosecute  or  participate  in  the  prcseeu* 

of  offenses  enumerated  in  18  O.s.c.  § 2516(1)  or  (3)  that  f 

c-nnrt * « UJ*  ^nax  provides  fne  basis 

■ of  Wire  ora^  and/cr  *n  0rd?r  the  requested  intercept! 

OI  WjLre'  oral,  ana/or  electronic  communications;  and  ’ 

C*  A,  set  of  orders  to  be  sioned  bv  the  ccur^ 

. or  approving  the Intention  of  , ?hl  SlUf  I-S?*  IS%f  ff  *°  L 

communications  that  are  the  subject  of  the  aoolica-i nn  *?C'  Jr  e*ectrona|c 

redacted  orders  to  be  served  on  srv  ' inc.uama  appropriate* 

• 8,Da  served  on  any  relevant  providers  of  "e’Uctvonir  n 

communication  service",  {as  defined  in  18  o.s.c.  § 2SiouS}).~  ct-onic 

9-7.110/’  • : 

y*S.  Attys.  Man.  9-7.110 
END  OF  DOCUMENT 
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' UNITED  STATES  ATTORNEYS  MANUAL 
• , ' TITLE  9-CRIMINAL 

■ CHAPTER  9-60.000  PROTECTION  OF  THE  INDIVIDUAL 
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9-60.202  .Illegal  Electronic  Eavesdropping — Prosecution  Policy 

The  .Germinal  prohibitions  against  illegal  electronic  ^ , 

- Title  111  are  part  of  the  same  act  which  S eavesdropping  contains 

f ^r*e  same  act  wnicn  permits  federal  law  enforcement 

■the  Sir  SKc*  on, ^eotrontc  «»«iUtW.  Congress  vie 
the  s^e  Si  L a'JthorizMi0n  a.  two  sides  c 

court-authorized  electronic  surveillance  may  depend  on  ltt'vlL^Tg&V  171 

the  DepK-man^J  ,*•  1 **  ex?ctr0JUC  eavesdropping.  Accordingly,  it  i 

zna  ueparument  s policy  uo  vigorously  enforce  these  ^ x 

The  ^trrtent T rvtTi&r'ai  i x prohibitions ■„ 

ptteerUv'^  Serso°riS  .Cr  P°llCy  Under  18  <J-SX-  * is  to  to 

pe“  of  t4  9 °l  procace  iile3sl  electronic  surveillance  » 

ox.  me  practice  or  their  'profession  or  ^ , * 7 

set ^ f * ' * * ■ ^ ^ incident  uo  their  business 

uCL*Vitie$ » emphasis  snoula  be  placed  on  the  , 

the  course  of  - 1 rans 7 tor v 4 v*.on  of  persons  who 

without  'S*  L5iS^  ^ i COsnmunicationS  on  their  own 

, *-ue  «3»*5cance  ox  a professional  wiretaooer  or  A»tr<ie^rAv,«»v  . , 

not  mean  that  such  persons  are  never  to  be  prosecuted!,  but  Jw^H*  °! 

Cvn?f°®nUti?n-XS  not  a ma^or  thrust  of  ^Department's  enforcement nv-Sil™ 
rSltion 

enforcement,  and  [5)  intra-business!  The  laroest^uSer^^nterLptLns 
than  75  .percent,  are  in  the  domestic  relations  cat^f  Z 

commuLStionsrwh-Sih  fT— ®n<*  prosecute  illegal3 interceptions  ?f 
communications  wmch  fall  within  the  industrial  snriU^x^i  „ . 

enforcement,  and  intra-business  cateoories  Generali?  su!h  v!  f^°nege'  law 

. interstate  ramifications  which  will  make  federal  oroLJI!?  Vioiations  wili  ha 

pcos  eeption - Nevertheless,  in  esses  “ « 

be. appropriate  to  . defer  to  state  prosecution.  1 interest  15  slight,  it 

Illegal  interceptions  arising  from  domestic  relafeiftr>s  rfCer,,,. 

present- less  of  a federal  interest  and  therefore  ?«L flsputea  9«nerally 

appropriate.  However,  this  do«lot  w« 'that "“T**10!?  is 

soaicate  responsibility  for  prosecutino  such  iBt*»ewti<n»*Crt?!tt*?,W 

the  preponderance  of  this  kind  of  < nterceot* on*  n«  -If1®3,  Indeed,  in  view  o 

effective  without  the  initiation  of  some  prosecution^fn^?^  prograra  can  b« 

United  States  Attorneys  should  develop  effective  li^Lln  purposes 

in  orOet  to  convince  thm  to  shoulder  their  share  of'the  burlJ°Ca  ?-ose^to 

private  detective,  attorney,  o^any  «pie^  Sd* 
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.are  the. lowest  priority  cases  for  federal J *nvolv?  a professional  intercept© 

ISStfci*  n°f“Uy 

eiOlatlotiS'  ofthkj“J£  »ilie?ometimerprSe°to”'be  "j  •»«»»»*«••  MwSthSh 
warrant  either  federal  or  state  pS?Suti?n  in  «u-f  insufficient  magnitude 
prove . sufficient,  • for  example,  a civil  suit* for  othee  measures  0$ 

suppression,  of  evidence  m U.S.C.  § 2515}*  or  foSi*uJ  S 2520> ' 

eavesdropping  paraphernalia  {1$  D.S.C.  ^ 551  *?i  si^ure  0..  uhe  wiretapping 
. ”xshurbed  persons  often  susoect  that  *Hpv  a »-&**>> 

Si.fff  — ’ complaint  »h“h  Ule«al 

the  th!  tel«P^n«  normally  does  not  SUSpicious 

the  laiwial  line  check  fails  to  produce  indepe^nrevlSrof rXo^ti0tt 
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Datasase 

USAM 


: united  states  department  of  justice 

UNITED  STATES  ATTORNEYS  MANUAL 
: : . . TITLE  a-CRIMINAL 

; - . CHAPTER  9-60.000  PROTECTION  OF  THE  INDIVIDUAL 

September  1997 

9-60.262  Prosecutive  Policy — 18  U.S.C,  $ 2512 

Flagrant  violators  of  18  U.S.C.  5 2512  should  he  prosecuted  viaorouslv 

a°buSi«srSSSS  S“"h  de',iCeS  in  0rder  t0  “«•*•  in  •liitwnih 

£«***•  <* 

"In  8fln>*>a«»«  • a - TFh  lt  ~,  sheets  tor  more  lenient  disposition 

-24S5  J!  a warning  may  be  sufficient.  Nevertheless,  in  all  cases  r 

perhaps,  for  minor  advertising  violations,  the  United  states 

f?ouif„re^rs  that  ths  prohibited  device  either  be  surrendered  vo-untpri 
the  FBi  or  forfeited  pursuant  to  18  U.S.C.  § 2513.  voluntarily  t 

2-60. 262 . 

O.S.  Attys.  Man.  9-60.262 
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7/20/00  6:20PM 
Don  Kerr's  Testimony 


The  revisions  that  t just  gave  you  do  not  include  a fix  for  the  problem  that  we  just  discussed  nameSv  the 
difference  between  T-lil’s  standards  for  interception  of  oral/wire  communications,  and  those  for  electronic 
communications.  The  former  are  set  forth  in  18  use  2516(f),  the  latter  in  18  USC  2516(3), 

For  the  purpose  of  this  testimony,  the  two  main  differences  are: 

(1)  that  applications  under  2516(3)  do  not  require  senior  level  DOJ  approval  and  (2)  that  they  are  not 
limited  to  "certain  federal  felonies.  Tte  if  * strike  the  sentence  at  Sie  t«om  of  ^ge  Sop  of  page 
three  (refemngto  authorization  by  a senior  official  of  DOJ)  and  the  last  sentence  in  the  first  paragraph 
of  page  three  (“Further,  interception  of  communications  is  limited  to  certain  specified  felony  offenses  n 
we  will  remove  some  of  the  misleading  Inferences  as  to  which  provision  we  follow  when  seekino  court 
approval  to  intercept  e-mail.  There  may  may  be  other  instances  where  the  testimony  suaoests  that  we 
use  2616(1)  rather  than  2518(3);  OGC  should  scrub  the  testimony  again  to  cSTorSSncS 
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[Carnivore 


From: 

To: 

Subject: 


W PARKINSOf 
Carnivore 


( S^SH9s#^«‘ 

^asa^ed  ha{  next  week  there  wiii  be  House  hearingsSthatDn  Kerr  and  yoSSHHH 
tedSSKSlof  WiVeSd  an  op@nins  sta!ement  tfia{  wi,!  ^corporate  both  the 

■j£nj|i|p[l 2S ' thSemlnt9  SU  y f°r itS USe‘  If thiS meetS with your approval- b0^ 

toc2id°2  Ln8fStW«?c  pa?ka9eih8t“n  be  installed  in  box  that  can  easily  blend  with  other  devices 
mSnifo,  XP'  V-  l used  und8r  cotJrt  3rder; « ^ not  a continous  running  system.  The  software  is 

wientrf' IS  2*5SS?4*,f  k fnt  t0  3 fieW  off5ce  when  needed*  ft  was  developed  by  us  because  we 
were  not  able  to  diferentiate  between  customers  and/or  messages.  Jugdes  were  authormm  verv  nafr™, 

Carnivore  Sffe"  uo  from  {°  "T*!  °Uf  interception  up front  rather  that  with  post-minimization 

intercept  ff  P * d captures  only  those  e-maiis  we  are  authorized  to  intercept  or  wnat  to 

dC\1hif  i{  d06S  this  ,housh  a series  of  *»««.  filters  allow  you  to  exclude  those  e-mails 

eX8mp  e ’ me  5ubJect  of  your  0338  is  represented  by  counsel  and  communSes 
with  him  via  e-mail.  You  can  program  Carnivore  so  that  you  will  not  capture  these  e-mails  Or  vn  . wnt 

sss is r ail his web traffis <Le- his ^K5^s£uS y n8t 

pmtedofnofinvXr  'Percepts  just  to  web  mail.  Therefore,  it  is  adauliy  a privacy 

Data  is  not  stored  on  the  Canivore  device,  it  is  stored  on  a disc  or  zip-drve  that  is  locked  bv  kev  hv  ih* 
f9«  f « droved  only  by  «w  agm  s0  as  to  raa|„,|an  «**„  ^y  ^ to  fton  KhXi 

at  the  fifw  °rfCe  f nd  placed,ntoa  readin9  device.  There  is  an  additional  minimization  step  tha ft  occurs 
n ! f to  ensure  that  the  case  agent  does  not  read  any  e-maiis  that  he  is  not  authorize  to  use 
h»  -*  ih8C8Lift  °,rdfr-  ^e  may  have  information  up  front  that  aliows  us  to  filter  e-mails  but  there 
Since  d.eterm,ne  brought  the  course  of  the  intercept  that  there  are  e-mails  we  can’t  have 

fhT™  f °^urf?amiVdre  intercepts  are  not  real  time,  we  need  to  post  minimize  Once  we  leam  that 
we  Sl?« >*  back  to  toe  devica  and  add  Sites  to  toe  prcgtam  so  mat 

*fb8nded  tw0 £fcrisfings  last  week.  One  was  with  the  Judiciary  Committee  minority  staffers  They 
seemed  more  interested  in  understanding  how  Carnivore  works,  how  tong  we  have  been  using  it  for 

m.frtSufr0^868  3nd  Tre?U,te  con!en{  0f,ce  ,hey  Earned  that  we  only  use  Carnivore  pursuant  to  a 
court  order.  They  seemed  quite  satisfied  with  the  briefing. 
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FBI’s  Wiretaps 
To  Scan  E-Mail 
Spark  Concern 


By  Nkh,  King  Jr. 

And  tm  Bmms 

S^f  UepKTiers  0/Tuk  Wall  *****  J^kkal 

WASHINGTON -The  Federal  Bureau 
m investigation  is  using  a superfast  sys- 
tem called  Carnivore  to  covertly  search 
e-mails  for  messages  from  criminal  sus- 
pect$L 

Essentially  a personal  computer 
stuffed  with  specialized  software,  Carni- 
vore represents  a new  twist  in  the  federal 
government’s  fight  to  sustain  ffs  snooping 
powers  m the  Internet  age.  But  in  employ- 
ing the  system,  which  can  scan  millions  of 
smalls  a second,  the  FBI  has  upset  pri- 
vacy advocates  and  some  in  the  computer 
industry.  Experts  say  the  system  opens  a 
thicket  of  unresolved  legal  issues  and  pri- 
vacy concerns.  p 

The  FBI  developed  the  Internet  wiretap' 
ping  system  at  a special  agency  lab  at 
Quanto,  Vsu,  and  dubbed  It  Carnivore  for 
Its  ability  to  get  to  “the  meat^  ofowhai 
w’ould  otherwise  he  an  enormous  quant! fy 
or  data,  FBI  technicians  unveiled  the  Sys- 
tem to  a roomful  of  astonished  industry 
specialists  here  two  weeks  ago  In  order  to 
steer  efforts  to  develop  standardized  ways 
of  complying  with  federal  wiretaps, 'Fed- 
eral investigators  say  they  have  used  Car- 
nivore in  fewer  than  100  criminal  cases 
since  Its  launch  early  last  year,  ■ 

Word  of  the  Carnivore  system  has  dis- 
turbed many  in  the  Internet  Industry  be- 
cause, when  deployed,  if  mixst  be  hooked 
directly  into  Internet  service  provided 
computer  network.  That  would  give  the 
government , at  least  theoretically,  the  ahil- 

ity  to  eavesdrop  on  all  customers’  digital 
communications,  from  e-mail  to  online 
banking  and  Web  surfing. 

The  system  also  troubles  some  Internet 
service  providers,  who  are  loath  to  see 
outside  software  plugged  Into  their  sys- 
tems. In  many  cases,  the  FBI  keeps  the 
secret  Carnivore  computer  system  in  a 
locked  cage  on  the  provider's  premises, 
with  agents  making  daily  visits  to  retrieve 
w the  data  captured  from  ihejproviderts  net- 
work. But  legal  challenges  to  the  use -of 
Carnivore  m'e  few,  and  judges’  rahngs^e-h 
main  sealed  because  of  the  secretive  ©a* 
tee  of  the  Investlgatipns,  ’ : : 

&rc  conducted  only, 
under  state  or  federal  judtdsl.o^  and 
ocotjcMv^  inffepente  The  h%e  m 
jori^f^etapscondnue^o  he  tetrad^ 

dSa fm*m  ^ 


TO;  The  computer  indostfy 
mo^TheFBf 


DATE  IJjl 
FAGE/^h^ 

\Y$C ■ mz  V ^ V ^ ^ 


j 1*  The  FBI  installs  one  of  its  off-the-shelf  PCs  at  the  Internet  service  provider  of 
the  surveillance  target 

2*  The  PC  checks  e-mails  passing  through  the  ISP  for  information  that  indicates 
whether  an  e-mail  is  going  to  or  from  the  target. 

3*  if  it  is,  the  PC  copies  the  full  text  of  the  e-mail  to  the  PC's  removable  hard 
dnve,  which  an  FBI  agent  collects  daily. 

4*  While  it  does  analyze  the  destination  and  sender  of  other  e-mails  Carnivore 
does  not  retrieve  their  full  text. 

S*  Once  the  surveillance  ends  (average  45  days),  an  FBI  agent  gathers  the 
computer  from  the  ISP.  ' 


Is  growing  as  everyone  from  drug  dealers 
to  potential  terrorists  begins  to  conduct 
business  over  the  Web, 

The  FBI  defends  Carni  vore  as  more  pre- 
; me  than  Internet  wiretap  methods  used  in 
me  past.  The  bureau  says  the  system  ah 
I lows  investigators  to  tailor  am  intercept 
operabon  so  they  can  pluck  only  the  digh 
1 ™ traffic  of  one  person  from  among  the 
| stream  of  millions  of  oilier  messages.  An 
aptly  code-named  Onrni- 
1 suck  In  as  much  as  to  six  gh 

gabytes  ;of  data  every,  hour;  Mi  In  a less 
V'f  / , 

Tv contend  that  Carnivore  is 
: open;fo  abuse>v-'  Vy- V*  > 

\ 4 Easchv'a  former  federal  com* 
puter^rimes  prosecutor,  said  the  nature  of 

f; tant^ri^cy  quesfionsi-s&ce  it  SaS 
> part  <jf  every  snippet  data  tramc  that 

Swpast,  if  only  to determine  whether  to 
record  it  for  police,  >.  . ; 

; ; : "ft’s  the  electronic  equivalent  of  Men- 
j Everybody’s  phone  calls  to  see  if  ft’s 

h w*.  7m  de^<aSen- 
I dons  amount  of  Mormafiom* 

! Others  say  the  technology  dramatizes 
how  far  the  nation’s  laws  are  lagging  be-  ' 
hind  toe  technological  revolution  “%js  is 
a clever  way  to  use  old  telephone-era  stat- 
fts  to  meet  new  challenges,  but  clearly 
there  is  too  much  latitude  in  the  current 
law,  said  Stewart  Baker,  a lawyer  special- 
izing in  telecommunications  and  internet 
regulatory  matters.  . -™1 

Robert  Cora-Revere,  of  the  Hogan  $J  ' 
Hartson  Jaw  firm  here,  represented  an  \mif 
denhfied  Internet  sendee  provider  men, ! i 
of  the  few  legal  fights  against  Carnivore  ~ 

! Me  said  his  client  worried  that  the  W 
; wotdd  have  access  to  ail  toe  e-mail  trafa<  : i 
pn  .its  system,'  raising:  dire  privacy,  ant  I 
security.,  concerns,  A federal  -magistrate  f I 
ruled  attest  toe  companyaarty'this  year  ! I 
leaving  it  no  option  hut  to  allow  toe  FBI  I * 
access  to  Its  system,  ’■  . { 

i to  desperate  need  of 

clarification  from  NCtagres|,£;«^  Afir,> 


Oun-Revere. 

, software  is  applied  to  toe 

ISP,  there  $ no  check  on  the  system,"  said 
Hep,  Bob  Barr,  R-Ga,,  who  sits  on  a House 
judiciary  subcommittee  for  constitutional 
affairs.  ”If  there’s  one  word  l would  use  to 
describe  this,  If  would  be  Trightfenlng.1” 
Marcus  Thomas,  chief  of  tlie  FBI’s  Cy- 
ber Technology  Section  at  Quanto/ said 
Carnivore  represents  the  bureau’s  effort 
to  keep  abreast  ofrapid  changes  in  Inter- 
oet  cornmtinlcations  while  still  meeting 
. the  rigid  demands  of  federal  wiretapping 
statutes.  “This  is  just  a very  specialized 
sniffer,"  he  said,  . • > .*  Y 

'He  also  noted  timt  criminal  and  civil 
penalties  prohibit  &e  bureau  from  placing 
unauthorized  wftetaps,  and  any  informa- 
tion gleaned  ,is  those  types  of  criminal 
ca^ef  would  he  thrown  out  of  court  Typi- 
eal  Internet  wiretaps  last  around  fs  days, 
after  which  toe  FBI  removes  the  equip- 
ment. Mr.  Thomas  said  toe  bureau  usually  ‘ 
has  as  many  as  26.  Carnivore  systems  on 
hand,  "just  to  case.*’ 

FBI  experts  acknowledge  that  Cami- 
TOre’s  monitoring  can  be  stymied  with 
computer  data  such  as  e-mail  that  is 
scrambled  using  powerful  encryption  tech, 
oology.  Those  messages  still  can  be  cap- 
, lured,  hut  law  officers  trying  to  read  the 
contents  are  “at  the  mercy  of  how  weii  it 
was  encrypted,”  Mr.  Thomas  said. 

Most  of  toe  criminal  cases’  where  the 
, usf«  Carnivore  is  the  past  18  months 
focused  on  what  toe  bureau  calls  “infra- 
structure protection,"  or  toe  hunt  for  hack- 
ers,  though  it  also  was  used  in  counterter- 
rorism and  some  drug-trafficHng  cases 
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By  D.IAH  HOPPER 
xTte  AssocsatedftBss 


? !ibert?S  30(3  pnvacy  9rouPs  are  M'm  against  a new  system  designed  to  allow  law  enfomemerif 

> 336015  *******  ^ *■*»  huge  amounts  of  twnaif  In  connection  with  an  investigation.  *™man* 

D»^«n.  oMM  "CamtaV  was  tot  hinted  at oa  Apdl  6 in  testimony  to  a House  subcommittee.  Now  the  FBI  has  it  in  4 

^^^olaSi''p^.,”W,  S^“  ^ “ “«  «“  «■  «***  emiails  tor  messes  associated 

In  a tetter addressed  to  two  members  of  the  House  subcommittee  that  deals  with  Fourth  Amendment  ^ ■'  - 

2£S;r  CiVl Ub!?s  Union  Sf3ued  «*  breaches  the  internet  pmS^s  “** 

customer  by  readmg  both  sender  and  recipient  addresses,  as  wet!  as  subject  lines  of  ifda^e  Si? f „ 

copy  of  the  entire  message.  miss  or  e-maiis,  to  decide  whether  to  make  a 

Further,  white  the  system  Is  plugged  into  the  internet  provider's  systems  it  is  contmittsH  cn^w  u,. , • . . , 

m a traditional  wiretap,  the  tap  is  physical  placed  and  maintained  by  the  telephone  c^y  enforcement  agency. 


*£Z1£  ,ml  ,m  such  8 da"al,  - ■»  »od 

p Ano  even  then,  he  sard,  the  data  mined  by  Carnivore,  particularly  subject  tines,  are  already  intrusive. 

*'t  r . . ..  - ... 


congressman  had  no  com^^onlhe  tetten  ’ V*°  headS  the  H°USe  JudlC,afy  sut>committee  on  the  Constitution,  sard  (h 

in  testimony  to  Canady's  subcommittee,  Robert  Com-Revere,  a lawyer  at  the  Hooan  A Harfcnn  u. 

Wnted  anhtemet  proper  that  reused  to  install  the  CamiJTsysf^  The  ^ ZZ^T'  ^ he 

Com-ftewre  sard,  because  the  comnanv  foam*  c.  «»«■&*«,  > 7 pfovaer  was  placed  in  an  awkward  posit  on,* 

use  me  company  feared  suits  from  customer  unhappy  with  the  government  looking  irib  all  the  »«£ 

It  was  acknowledged  by  the  government)  that  Carnivore  would  enable  remote  «ntM  tX  ieo<  7 • , ••  t* 
the  exclusive  control  of  government  agents,*  Com-Rewre  said.  access  to  the  ISP  s netwodt  and  would  be  under 

&wn4bwre  toid  the  committee  that  current  law  is  insufficient  to  deal  with  Carnivore's  mtentmi  at«*  «,  , , . 

2£?£ST PM  bee*,  ot ft.  IMM  comtoctioo to tetopho™ tea.  am. that' «i CS SSdtST 

not  tewaa!  the  name  ot  his  cbent,  ®it)  toe  ctiaot  tost  the  oaao.  Ho  said  toe  FB,  baa  boon  u*p  Cam™*  erne. 

^XOempaoy.  Motor  sM  counao.  at  too  Comer  lb,  (Wrnoy  ano  Tochnotopy.  said  th.  main  pmbtam  wtth  Caml»m  la 

ttaTtSotodSS-8  ““  **“’* "" ”'6W*  * Bp‘ ta»«r  *>“•  "Not ow  to  ISP  koows  exactly  what 
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■^^•wryMgto tte  FBL  W?"""  ••*•"*>««  “>*r  • ""*>  *m*t.  The  cartels  complained  that  toy  h 

I "*  “"“  °*m'  °mimi  S,la'  "By  “*•  “ billon,  they 

* I^itA?^®'L?lree‘ Joumal  lhal  lte bureau  has  atroul  20 

to  keep  upwfththefrrtemet  V ‘ e satd  Camiwe  meets  current  wiretapping  laws,  but  is  designs 

sjtx  ; ^ '+ . ^ 

eSSf*^  done  rrtth  an  email  encoding  program  like  PGP,  sK  .(aye  to  cocte  „ ift  ^ )0  ^ ^ 

| d““Pa.^l^ti^S^S5S2^'lo‘intt^^lJfeSSh^2,IISliPr0b^'y  “n'"'"'>"  •’***•  •“ 11  *«•  *d  how  It 

i ~'lKFBI  •’h***  mM‘e  Ms  «t™»  an  open-source  product.-  tie  said  "then  the  secret  is  gone.- 
On  the  Net  Federa!  Bureau  of  investigation:  http://wvwfbi.gov 
American  Chff  liberties  Union:  http://www.aclu.org 
Center  far  Democracy  and  Technology:  http://www.cdt.org 
Pretty  Good  Privacy  {PGP}:  www.pgp.com 
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Stop  Snooping  on  E-mail 

(APBnevvs.com)  - Die  pressure  is  mounting  on  the  Justice  Department  to 
* # new  FBI  wiretap  system  P cmt0 

that  »r  ffWi/C  artAn+o  «* 


access  to  vast  amounts  of  e-mail  traffic. 

< V :' '■?: .v\.  -;  - c V-'\  .:•>.  ••  rVjV’t  •<£'*'•  x . ..  . 

• •,  ■ , • ••  ••  .•:•  v<- 


^«^alied  Carnivore  system,  which  has  come  under  fire  from  law-makers  as  well  as  civil 

liberties  groups  since  revelations  about  its  existence 

surfaced  fast  week,  gives  the  FBI  widespread  access  to  monitor  Internet  service  providers. 
Iteo^er  this  week  urging  her  to  put  the  wiretap  system  on  hold  until  privacy  concerns  are 

££3SSr:C C0Kems  “ a“” **— 

Ca“E'^  ‘^.^.Obeapubnc 

going  on  for  a year  and  nobody  knew.” 

Reno  ordered  review- 

or<,erai  a re™w  °f  1 te  - *-  «* 

today, 

w“^!  she  “"deBlan‘b  * md  fct  * is  *#* 

adequately  addressed.”  * • 

'The  keys  to  the  kingdom' 

R^.  Bob  Barr  - who  described  the  Carnivore  system  surveillance  abilities  as  “ffightenine"  - 
tnay  demand  similar  restraints  at  a congressional  **  ® 

oversight  hearing  on  the  program  next  Monday,  a spokesman  said.  . ‘ 

Republi&^gmeCl  ab0“ tlK  “ of  «** B-*>  Alexander,  a spokesman  for  ft,  Qeorgia 

Civil  libertarians,  also  outraged  at  the  extent  of  the  FBI’s  ability  to  monitor  the  e-mails  of 
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imioeent^ople'  also  want  Carnivore  suspended, 

Bmy  Stekhardt!  who  is tcheljtho  teUfy  aT"^  Cml  Ubcnks  Union  Associate  Director 

ex|wct  us  to  trust  them.  WdM  don’t. They  have  Si™mi  °fc°mmuaications’ and  {he>' 

a^^??a^USe  211(1  stretcilin&  the  ilmits  of  what  they  are  entitled  to," 

A critical  tool,  FBI  says 

j t 

; 

agency  wants  ^ ftTpublte l>w  C^iTOre1™™  Sp°te™“'  Paul  Brcsson'  w110  U>= 

are." 

2;-*^*^ ,he  !ys,cm  8ives  agen,s  fc  » 

ma'  Wi'"aPS  haV<!  “ ‘°  COm'iC,i°"S  °n5-600  **» to  1 3 years,  according  ,o  .he 
New  wiretap  rules  sought  * 

proposals  (hat  woSd  require  a Chu:rof  SlaffJoh"  announced 

S2. l£Z£Z£S^  W“e  a‘ "*  “»“«”*  «•  Ws  ability 

The  ACLU  said  the  White  House  did  not  go  far  enoueh  in  in  r^sr.n«c  , * 

surveillance  powers.  S gh  1 te  resPonse  to  increasing  government 

should  have  "disavowed **  Carmvore'"  he  said,  when  die  administration 
Smm t^KT"''  **  litt'e  Cte“  °f ' “■«  — »«r  Clinton 

LU  °n  Frid?y  f,led  a F,K!dom  of! Ih&nuation  Act  request  for  the  souree  code 
computer  program  instructions,  and  other  technical  Ce  co^c>  or 

■SSSSS  !”l“SITSram' ^ ® “d  * Wili  "ith  FOIA  rules  and 
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CONGRESS  OF  THE  UNITED  STATES 

1207  lONGWOBTH  HOUSE  SUJIOiNG 
WASHINGTON,  D C,  20515*100? 


July  24,  2000 


COMMITTEES 

JUOIDAfiy 

BANKING  ANO  FINANCIAL  StRViC 
GOVERNMENT  RffORM 

Suttfttmtottiet  i J*> 

D<u§  Pottcv,  *«■ wj  Hum* a Rtsow^ei 
VICE  CHAPMAN 


The  Honorable  Louts  i.  Freeh 
Director 

Federal  Bureau  of  Investigation 
935  Pennsylvania  Avenue  NW 
Washington,  D.C.  20535-0001 


IN  R£:  Request  for  Information  Pertaining  to  Carnivore  Svstero. 

Dear  Director  Freeh: 

In  light  of  the  recent  disclosure  of  the  Bureau’s  use  of  Carnivore,  and  given  the 
substantial  public  interest  in  this  matter,  J hereby  ask  to  review  all  records  concerning 
the  Carnivore  system. 

Included  in  the  records  should  be  : 

* A description  of  Carnivore ’a  capability 

► A history  of  Carnivore’s  development  and  use 

*■  The  number  of  cases  in  which  Carnivore  has  been  used,  and  the  number  of 
Internet  Service  Providers  (ISP)  that  have  had  the  system  installed. 

* An  analyses  of  the  legal  issues  the  Bureau  considered  before  deploying  the 
system. 

White  t wuuid  welcome  any  explanatory  information  the  Bureau  is  willing  to  provide 
in  response  to  my  inquiry,  I am  requesting  the  original,  source  documents 
themselves,  and  would  like  to  receive  them  before  August  7,  2000.  Given  the 
potential  impact  on  the  public  of  Carnivore,  1 would  like  to  make  the'  material  1 
receive  public,  and  would  like  the  Bureau  to  authorize  this  public  release. 

Thank  you  for  your  cooperation.  If  you  have  any  questions,  please  contact  my 
Legislative  Counsel,  Keri  Allin,  at  202/225-2931.  1 look  forward  to  reviewing  the 
information. 
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cc:  The  Honorable  Janet  Reno 

The  Honorable  Dennis  Hasten 
The  Honorable  Richard  Ar$tey 
The  Honorable  Tom  DeLay 
The  Honorable  J.C.  Watts 
The  Honorable  Dan  Burton 
The  Honorable  Henry  Hyde 
The  Honorable  Charles  Canady 
The  Honorable  Bill  McCollum 
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Washington 

IN  198,  the  Supreme  Court  took  up  the 
ease  of  Roy  (Big  Boy)  Dims  lead,  a 
bootlegger  whose  phones  had  been 
tapped  by  federal  agents  without  a war- 
rant The  court  ruled  that  evidence  obtained 
fcn  that  way  was  legal,  prompting  a remark- 
able dissent  by  Judge  Louis  D,  Branded 
“Hie  progress  of  science  in  furnishing  the 
government  with  the  means  of  espionage  is 
not  likely  to  stop  with  wiretapping”  Justice 
Braudels  wrote  in  a dissent  that  the  court 
adopted  as  the  law  nearly  40  years  later. 
‘'Ways  may  some  day  be  developed  by 
which  the  government,  without  removing 


The  White  House  proposed  replacing 
these  illogical  distinctions  with  a uniform, 
rational  set  of  standards.  Civil  liberties  and 
privacy  groups  support  this  idea  In  princi- 
ple, but  are  highly  critical  of  the  arfmfosstra- 
tion  for  refusing  to  explain  how  broadly  it 
intends  to  use  Carnivore  or  to  describe  what 
safeguards  are  in  place  for  preventing  its 
abuse,  •>.  ....  , * • 

*Law  enforcement  officials  say  that  com- 
puter systems  like  Carnivore  are  necessary 
because  e-mall  is  becoming  more  frequent- 
ly used  for  communication  among  crimi- 
nals, And  the  officials  note  that  these  cyber- 
monitors  can  actually  be  set  to  record  com- 
munications much  more  selectively  than  a 


t 


phone  tap. 

Carnivore  could,  for 


instance,  be  pro- 


papers from  secret  drawers,  can  reproduce  ( grammed  to  pick  up  the  e-mail  from  only 
them  la  court,  and  by  which  It  will  be'  ‘ y*  * '* * — * ,WS,A 


enabled  to  expose  to  a jury  the  most  inti- ; 
mate  occurrences  of  the  home,”  : 

’*  Thanks  to  the  ubiquity  of  e-mail  and  the  * 
Ingenuity  of  the  F2LL  that  day  has  arrived. 
Over,  the  last  couple  of  weeks  it  has  been 
Widely  reported  that  the  F.B.L  is  now  using 
■^computer  . program  called  Carnivore, 
which,  tmce  Installed  on  the  network  of  an 
llnteniet  service  provider,  can  troll  through  % 
^millions  of  e-mail  messages  and  hone  in  on  i 
rthc  electronic  correspondence  of  suspects, 

G far,  the  F*B X has  reported  using 
the  program  fewer  than  25  times 
since  ft  was  developed  18  months 
agp,  but  that  number  is  expected  to 
grow  quickly,  since  the  bureau  expects  ft  to 
become  an  indispensable  law  enforcement 
tool,  particularly  in  international  espionage 
and  terrorism  cases. 


Si 


{ That's  fine,  say  critics,  but  Carnivore  is 
{also  capable  of  simultaneously  monitoring 
the  communications  of  people  not  suspected 
of  a crime.  That  has  caused  civil  liberties 
♦groups  and  privacy  advocates  to  worry  that 
the  technology  might  be  used  to  monitor 
.unpopular  groups  or  political  enemies,  and 
[not  just  suspected  criminals, 
p Last  week,  as  lawmakers  on  Capitol  HU! 
began  voicing  their  concerns,  the  White 
teouse  moved  to  calm  the  growing  storm, 
tffohn  Poteta,  die  president's  chief  of  staff, 
fegfe&t^  that  would  set 

* mpdremems  tor  surveillance  In  cy- 

^ v * * 


one  sender  and  a particular  co  mputer,  while 
excluding  such  e-mail  as  messages  to  or 
from,  say,  the  sender's  lawyer  or  wife. 
Phone  taps*  on  the  other  hand,  pick  up 
everything. 

At  a news  briefing  on  Friday,  top  F.B.L  f 
officials  also  announced  plans  to  submit 
Carnivore  to  analysis  by  independent  aca- 
demics, and  noted  that  the  system  kept  a Jog 
of  what  It  was  asked  to  pick  up,  which  could 
bo  used  by  a court  to  spot  any  violations* 

in  making  their  case,  supporters  of  cyber- 
suryeiiiance  say  that  the  only  way  to  track 
e-mail  is  by  combing  through  all  of  the 
messages  on  a particular  network,  because 
e-mail  consists  of  a senes  of  digital  packets 
that  are  broken  apart  at  the  sending  end  and 
transmitted  along  multiple  electronic  paths 
before  being  reconstituted  by  the  recipient's 
computer. 

Nonetheless,  privacy  groups  and  some 
Internet  service  providers,  or  L$.P.%  say 
there  remains  a less  intrusive  alternative.  , 
The  providers,  like  ACL  or  the  Microsoft 
Network,  could  be  ordered  by  a court  to  turn 
over  specific  material,  rather  than  give  the 
FJ3X  unlimited  access  to  a network-  That  is 
precisely  how  telephone  companies  are. 
treated;  they  cooperate  with  warrants  for 
wiretaps  and  lists  of  telephone  numbers 
called  from  a particular  phone. 

“The  real  question  Is  who  should  be  in 


to  red  by  computers  and  more  easily 
masked  by  encryption. 

As  even  household  appliances  begin  to  be 
wired  Into  the  Internet  mid  many  of  our 
most  personal  thoughts  and  associations  are 
ndw  shared  with  the  computer,  the  issue  has 
taken ^on  a new  imperative  and  is  -being 
debated  on  a global  scale. 


T! 


HE  British  government  (whose 
house-to-house  searches  in  the  Eng- 
lish colonies  led  to  the  Fourth 
Amendment  prohibition  against  un- 
reasonable searches)  is  near  to  adopting  a 
law, the  Regulation  of  investigatory  Powers 
Bill*  or  RJLP.,  that  would  require  Internet 
sendee  companies  to  finance  the  permanent 
installation  of  a Carnivore-like  system  for 
government  use, 

A similar  system  is  already  in  placer,  in 
Russia,  while  in  the  Netherlands  a debate  is 
raging  over  whether  the  government  should 
have  the  authority  to  tap  into  e-mail  at  all'* 
“Thls.debate  really  cries  out  for  a return 
to  first  principles  ” yak!  Marc  Rotenberg. 
director  of  the  Electronic  Privacy  Informa- 
tion Center,  a research  organization  that 
studies  privacy  issues  and  technology. 
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control,”  said.James  X.  Dempsey,  staff  at- 
torney for  the  Center  for  Democracy  and 
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Statement  for  the  Record  of 
Donald  M.  Kerr,  Assistant  Director 
Laboratory  Division 


Before  the 

United  States  House  of  Representatives 
The  Committee  on  tee  Judiciary 
Subcommittee  on  tee  Constitution 
Washington,  D.C. 


Carnivore  Diagnostic  Tool 


Good  afternoon,  Mr.  Chairman,  and  Members  of  the  Subcommittee  i am  n«»i<sittt  in, 

tee  FeSEanin  SS  *?  ^em®Land  data  interception  capabilities  developed  by 
oe  Federal  Bureau  of  Investigation*  The  use  of  computers  and  the  tnt&mof  i©  nrAU?:n^ 

cr^es’ami  m h6C!  b^.8Xf)!ftat'0ri  °{ computers,  networks,  and  data  bases  to  commit 9 
comnuuS L secfity* afld  PrtvacV'  of  others.  Criminals  use 

pornography  to  each  other  using  anonymous,  encrypted 

customer'h^»SartrflterS  bre!,k tnfafinandaf  service  companies  systems  and  steal 
incvnanl- bom®  addres$es  ond  credit  card  information;  criminals  use  the  Internet's 
mej^ensive  and  easy  communications  to  commit  large  scale  fraud  on  victims* ail  ov«r 
detemnn  «?,rh  !?!rr0r‘:!f  bombers  plan  their  strikes  using  the  Internet,  investigating  and 
wrongdoing  requires  toots  and  techniques  designed  to  work  with  new 
S^«Sw°KP,U  ers  and  technologies.  The  systems  emptoyed  musSike  a 
bStween  C0fflpeting  interests-  the  privacy  interests  of  * 
telecommunications  users,  tee  business  interest  of  service  providers  and  th*  dnh/nf 

KtoSC0'8'0  f°tect  saf&ty‘ 1 wouId  «•»  to  discuss  how  tee  Fb/ 

»s  meeting  this  challenge  in  the  area  of  electronic  maii  interception. 

co2^ams^f^LH,a^  Street  Journal  published  an  article  entitled  "FBI's  system  to 
* u l E-fnaii  raises  privacy,  lagai  issues/  This  storv  was  irnrrc6ffet£*fv 

aaia  * r*" 01  “miiaf  "■»*  h «■»  ■»»«  bSssl  - 

ft,  nj^vraf  *Stem  38  ominous  anti  raising  concerns  about  tbe  possibltttv  of 

S£TiJ£X%£  ‘SZZSTS*;  •*“*  *>*-  E-maSfSSf % " 

S^EZ?*1  v’fet*s  aS°- (t  * critically  Important  as  technology,  and  particularfy 

ouarantSStSf^1^0^’  * co”tin“9s  to  «***  rapldtyf,  teat  tee  publicise 
guaranteed  that  their  Government  Is  ohservinn  tha  c****^,  *****  ~-.il*.*.  _*?_ 
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' * 

tojd^Pinte>n^f-  totomeptions  of  criminal  wire  and  electronic  communications 
tedudrng  teternef  communications,  under  authorities  derived  from  Title  E 
Omnibus  Crime  Control  and  Safe  Streets  Act  of  1968  (as SSi^mmonly 
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ISMte'SS1 Eiec,'°nl0 Commanloations^ Privacy Act  of 
exception crfai rafe/v Government interceptions, with m© 
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ssxnss  isfjsr!''  m °r *•' * *»  *»«** *5™* 

te  “Sris 

wl**  ■ ^,?l?'.0,  additional  pm&km 

the  privacy  of  Intercepted  cutsets  and  wih*u  used  fadciously, with  Reference  fo 

,,  noftheaJfKrioSSS^;”^ 11^<l®^tefcpri«cyof»«»,i«teare 
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lifh  ' ' TOwcepaon  of  wire  and  electronic  commtmicaflons  re  fh  # 

SSSSS£rs®SS® 

and  £la» 

1116  f'***  «"™"«tions  are ,0 

Identities  5 hSSSJS*''!1!  <»  intercepted,  aodthe 

Jg^ele^icsunre,^^ 

SSS  « !KrltT  taw  •— «* 

must  indude  inforniation  concemZa^l  or are  {°°  clanew>us,  and 

subject  or  facility  In  question Court  orttaS  S”?  ,e8Md>W  «» 

extensions possMe  and miiist  17^ " ™“y **ed to 30 days, vritti 
nay,  and  S °*ife«ves  are  m.  Judges 

ad&nS  • tt££g2  SfSESSS  SSf  T*  mmllf  «"* 7 *>  «*»». 

overelBM  of  the  eteewnie  Sundance  by  *?«»*!» 


conducted  In  suirit  a wav  as  io  v’fc'eeptions  are  required  fo  be  “ 

otherwise  subject  fo  interception"  under  "“ 

nond«„a,  convnuTCcalions  of  Ihe  subject  o"'S .SS^gt 

AwXoatlons  and  Men  signed  by  the  jud^re  £ totoMd  by  fifcdfe 

are  fun^had^n 
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FBI  ftwi  Room- 


J^Jll ®C  any  pensonv^owasa  part  to  an  intercenterf 

against  whom  an  Interception  was  directed  nrKtS?n7te  or  was  a 


tetercepfion  was  insuffictentonits  face  r authorosng  or  approving  the 

was  001  in  conformance 


m person  whose  communfcaions  am  imLwf  »,  ?^?r8* a or  both*  In  addition, 

:„.  ass^gg'T 

P a^iRSt  me  person  or  entity  engaged  in  the  violation.- 

Sl^m3SSSr2l5^oS)^SiSlMS*an?TOM^enCy 

SsHssBr^sisir8 

toSnlnSS toSSSmS?feillSf Si f h’’6'' P®1*0"  S,BI1 

Person  is  according  the  person  whose  land,ord>  oustodian,  or 

practice,  judges  may  sign  two  ordeS  we^SSSSS  bf inSefcepted in 
agency  to  conduct  the  electronic  surveillance  «nd^I!?n% thtiaw  enforcement 
otow;  directed  to  the  service  provider,  sScifyln?1or5S^^  assistance 

■J“9  tefe^wfSa5SSiW*«iySyte«ss2rdl?l°l,'e,S  (otan^"e 

ssssssa^^ 

among  others,  that  servic©  proKteStt^' !*is  forth{s 


product,  but,  in  many  cases,  ser^TSi  a L SS2??f  f 6 fina!  We^P«on 
lucres  to  issue’  the  i0  cook,  and  for  - ' 

SSK^iSiSSS  S^SaST'  Tre  “”&w 

sr sre-  *• te-  *. 

analog  communications.  For  exampte^ntemef u^i^f  diSCf'm!nafon  man  oider 
messaging  services,  like  E-mart  tn  «v»m.  .!uS*WS^ftB3uef^  088  atectronic 
reminiscent  of  a tetephonfS^  Mjvkiuals  i n a manner 

often  the  targets  of  court  oSdSeroeiS  h2^^  ‘ Such  m6ssaSe$  am 

««tte  web,  which  looks  momfflSS^^,U^ sere  also  use  services,  like  the  world 

internet  services,  like  stTimSSoTete  ^L**10"®  CafL  some 

« streaming  vtdeo,  have  more  in  common  with  broadcast  media 
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®!ses,  these  afaififes  are  satfsfactay  andSowS  S? ?d  user  accouf«s-  In  such 

a 25?* 10  ®wt  cases.  »SPs  do  n2  have  such  SSlSf  ^ a court  0ffter- 
3 S&CUfg  lH3nn©L  AL<2A  mrtti  > capabMios  or  cannot  omnimr  *w 


t^  lsp  fntemeptian  order.  The  FBI  also  depends  uj 


Anott^  primary  consideration  for  using  me  Carnivore  system  is  data  integrity.  As  you 
know.  Rate  901  of  the  Federal  Rules  of  Evidence  requires  that  authentication  of 
i c2ff  as  a Pfecondtoon  tor  admissibility.  The  use  of  ihe  Carnivore  system  by 
the  FBI  to  intercept  and  store  communications  provides  for  an  undisturbed  drain  of 
custody  by  proving  a witness  who  can  testify  to  the  retrieval  of  the  evidence  and  the 
process  by  which  it  was  recorded.  Performance  is  another  key  reason  for  preferring 
tots  system  to  commercial  sniffers.  Unlike  commercial  software  sniffers,  Carnivore  is 
designed  to  intercept  and  record  the  selected  communications  comprehensively 
without 'dropped  packets,* 

to.  conclusion,  * wou*d  fike  to  say  that  over  the  last  five  years  or  more,  we  have 

2*£?1  a5Sot‘ndini  steady  9fowth  to  instances  of  computer-related  crimes, 
mdudng  tradrtond  cdmes  and  terrorist  activities  which  have  been  planned  or  carried 

Glit.  Ifl  ftArf  this.  JnfawrtA*  TW*  ^ . . ■ . w 


tn  fWttiif,  ***  tmu,  uepenoem  upon  o m 

to  tewfuily  coiiect  vital  evidence  of  wrongdoing.  As  the  Internet  becomes  more 

Comdex,  so  do  the  challenges  placed  on  us  to  keep  pace.  We  could  not  do  so  without 
me  continued  cooperation  of  our  industry  partners  and  innovations  such  as  the 
Carnivore  software.  I want  to  stress  that  the  FBI  does  not  conduct  interceptions,  install 

and  operate  pen  registers,  or  use  trap  & trace  devices,  without  lawful  authorization 
irom  a court, 

iL°flrard  to  Workins  with  me  Subcommittee  staff  to  provide  more  information  and 
welcome  your  suggestions  on  this  important  issue.  I will  be  happy  to  answer  any 
Questions  that  you  may  have.  Thank  you,  * 
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Statement  for  the  Record  of 
Donald  M.  Kerr 
Assistant  Director 

. - Federal  Bureau  of  Investigation 

% ^1^':  ' Before  the 

Vh-:v%-  i United  States  House  of  Representatives 

< The  Committee  on  the  Judiciary 

Subcommittee  on  foe  Constitution 
^ . . » Washington,  D.C. 

. 7/24/2000  " 

' Good  afternoon,  Mr,  Chairman,  and  Members  of  the  Subcommittee.  I am  grateful  for  this 
opportunity  to  discuss  the  Internet  and  data  interception  capabilities  developed  by  the  Federal 
Bureau  of  Investigation,  The  use  of  computers  and  the  Internet  is  growing  rapidly,  paralleled  by 
exploitation  of  computers,  networks,  and  d ata  bases  to  commit  crimes  and  to  harm  the  safety, 
security,  and  privacy  of  others.  Criminals  use  computers  to  send  child  pornography  to  each  other 
using  anonymous,  encrypted  communications;  hackers  break  into  financial  service  companies 
systems  and  steal  customer  home  addresses  and  credit  card  information;  criminals  use  the 
Internet’s  inexpensive  and  easy  communications  to  commit  large  scale  fraud  on  victims  all  over 
foe  world;  and  terrorist  bombers  plan  their  strikes  using  foe  Internet.  Investigating  and  deterring 
such  wrongdoing  requires  tools  and  techniques  designed  to  work  with  new  evolving  computers  and 
network  technologies.  The  systems  employed  must  strike  a reasonable  balance  between  competing 
interests  - foe  privacy  interests  of  telecommunications  users,  foe  business  interest  of  service 
providers,  and  foe  duty  of  go  vernment  in  vestigators  to  protect  public  safety  . I would  l ike  to 
discuss  how  foe  FBI  is  meeting  this  challenge  in  foe  area  of  electronic  mail  interception. 


5/24/62  Release  - Page 

'2>oc.*rJL 


Tw  weeks  ago,  the  Wall  Street  Journal  published  an  article  entitled  "FBI's  system  to  covertly 
search  E-mail  raises  privacy,  legal  issues."  This  story  was  immediately  followed  by  a number  of 
^ similar  reports  in  the  press  and  other  media  depicting  our  Carnivore  system  as  something  ominous 

S > ,5*V ' y. . ...  ... 

and  raising  concerns  about  the  possibility  of  its  potential  to  snoop,  without  a court  order,  into  the 
private.  E-mails  of  American  citizens,  I think  that  it  is  important  that  this  topic  be  discussed 

; . ‘ ■;*  * !f  ■ ■■  : 

openly-and  in  fact  this  was  the  reason  we  choose  to  share  information  about  this  capability  with 
industry  experts  several  weeks  ago.  It  is  critically  important  as  technology,  and  particularly 
communications  technology,  a continues  to  evol  ve  rapidly,  that  the  public  be  guaranteed  that  their 
government  is  observing  the  statutory  and  constitutional  protections  which  they  demand.  It  is  also 
very’  important  that  these  discussions  be  placed  into  their  proper  context  and  that  the  relevant  facts 
concerning  this  issue  are  made  clear.  I welcome  this  opportunity'  to  stress  that  our  intercept 
capabilities  are  used  only  after  court  approval  and  that  they  ate  directed  at  the  most  egregious 
violations  of  national  security'  and  public  safety. 

The  FBI  performs  interceptions  of  criminal  wire  and  electronic  communications,  including  Internet 
communi  cations,  under  authorities  derived  from  Title  !H  of  the  Omnibus  Crime  Control  and  Safe 
Streets  Act  of  1968  (as  amended),  commonly  referred  to  as  "Title  111",  and  portions  of  the 
Electronic  Communications  Privacy  Act  of  1 986  (as  amended),  or  "ECPA".  Such  federal 
government  interceptions,  with  the  exception  of  a rarely  used  "emergency  **  authority  or  in  cases 
involving  the  consent  of  a participant  in  the  communication,  am  conducted  pursuant  to  court 
orders.  Under  emergency  provisions,  the  Attorney  General,  the  Deputy  or  the  Associate  Attorney 
General  may , if  authorized,  initiate  electronic  surveillance  of  wire  or  electronic  communications 
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a court  order,  but  only  if  an  application  for  such  order  is  made  within  48  hours  after  the 


surveillance  is  initiated. 


Federal  surveillance  laws  apply  the  Fourth  Amendment's  dictates  concerning  reasonable  searches 
and  seizures , and  include  a number  of  additional  provisions  which  ensure  that  this  investigative 
technique  is  used  judiciously,  with  deference  to  the  privacy  of  intercepted  subjects  and  with 
deference  to  the  privacy  of  those  who  are  not  the  subject  of  the  court  order. 


For  example,  unlike  search  warrants  for  physically  searching  a house,  under  Title  HI,  applications 
for  interception  of  wire  and  electronic  communications  require  the  authorization  of  a high-level 
Department  of  Justice  (DOJ)  official  before  the  local  United  State  Attorneys  offices  can  make  an 
application  to  a federal  court.  Unlike  typical  search  warrants,  federal  magistrates  are  not 
authorized  to  approve  such  applications  and  orders,  instead,  the  applications  arc  veiwed  by  federal 

district  court  judges.  Further,  interception  of  communications  is  limited  to  certain  specified  federal 
felony  offenses. 


Applications  for  electronic  surveillance  must  demonstrate  probable  cause  and  state  with 
particularity  and  specificity:  the  offenses  being  committed,  the  telecommimications  facility  or 
place  from  which  the  subject’s  communications  arc  to  be  intercepted,  a description  of  the  type  of 
conversations  to  be  intercepted,  and  die  iden  tities  of  the  persons  committing  the  offenses  and 

anticipated  to  be  intercepted.  Thus,  criminal  electronic  surveillance  law's  focus  on  gathering  hard 
evideace-not  intelligence. 


5/24/02  Release  » Page  521 


wdicatc  that  other  normal  investigative  techniques  have  been  tried  and  failed  i 
gather  evidence  of  crime,  or  will  not  work,  or  are  too  dangerous,  and  must  include  information 

. * “SS?!  ^0T  d>Smnic  survemanc«  regarding  die  subject  or  facility  in  question.  Court 

30  d^s,  with  extensions  possible,  and  must  terminate  sooner  if  the 
objectives  are  met  Judges  may,  and  usually  do,  require  periodic  reports  to  the  court,  typically 

, evety7t0  10  ^vising  ^ it  ofthe  progress  of  the  interception  effort  This  assures  close  mid 
V 0^lng  oversight  ofthe  electronic  surveillance  by  the  United  States  Attorney's  office  handling 
die  case  and  frequently  by  die  court  as  well.  Interceptions  are  required  to  be  conducted  in  such  a 
way  as  to  "minimize  the  interception  of  communications  not  otherwise  subject  to  interception" 

under  die  law,  such  as  unrelated,  irrelevant,  and  non-criminal  communications  ofthe  subjects  or 
others  not  named  in  the  application. 


To  ensure  the  evidentiary  integrity  of  intercepted  communications  they  must  be  recorded,  if 
possible,  on  magnetic  tape  or  other  devices,  so  as  to  protect  the  recording  from  editing  or  other 
alterations.  Immediately  upon  the  expiration  ofthe  interception  period,  these  recordings  must  be 
presented  to  the  federal  district  court  judge  and  sealed  under  his  or  her  directions.  The  presence  of 
the  sea!  is  a prerequisite  for  their  use  or  disclosure,  or  for  the  introduction  of  evidence  derived  from 
tire  tapes.  Applications  and  orders  signed  by  the  judge  are  also  to  be  sealed  by  the  judge. 

Within  a reasonable  period  of  time  after  the  termination  ofthe  intercept  order,  including  extension, 
the  judge  i s obligated  by  law  to  ensure  that  the  subject  of  the  interception  order,  and  other  parties 
as  are  deemed  appropriate,  are  furnished  an  inventory,  that  includes  notice  ofthe  order  the  dates 
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during  which  the  interceptions  were  carried  out,  and  whetehr  or  not  the  communication  were 
intercepted.  Upon  motion,  the  jusge  may  also  direct  that  portion  of  the  contents  of  the  intercepted 
communication  be  made  available  to  affected  person  for  their  inspection. 

Under  Title  HI,  any  person  who  was  a part  to  an  intercepted  communication  or  was  a party  against 
whom  an  interception  was  directed  may  in  any  trial,  hearing,  or  other  proceeding  move  to  suppress 
the  contents  of  any  intercepted  communication  or  any  e vidence  derived  therefrom  if  there  are 
grounds  demonstrating  that  the  communication  was  not  lawfully  intercepted,  the  order  authorizing 
or  approving  tire  interception  was  insufficient  on  its  face  or  the  interception  was  not  in 
conformance  with  the  order. 

The  illegal,  unauthorized  conduct  of  electronic  surveillance  is  a federal  criminal  offense 

+ 

punishable  by  imprisonment  for  up  to  five  years,  a fine,  or  both.  In  addition,  any  person  whose 
communications  are  unlawfully  intercepted,  disclosed,  or  used,  may  recover  in  a civil  action 
damages,  including  punitive  damages,  as  well  as  attorney’s  fees  and  other  costs  against  the  person 
or  entity'  engaged  in  the  violation. 

The  technical  assistance  of  service  providers  in  helping  a law  enforcement  agency  execute  an 
electronic  surveillance  order  is  always  important,  and  in  many  cases  it  is  absolutely  This 

is  increasingly  the  case  with  the  advent  of  advanced  communication  services  and  networks  such  as 
the  Internet  Title  III  mandates  service  provider  assistance  incidental  to  law  enforcement’s 
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a court  order  authorizing  the 


telecommunications  “service  provider,  landlord,  custodian,  or  other  person  shall  furnish  the 

■*  *,  ' \ . \ • < \ . . . r • 

applicant  forthwith  all  information,  facilities,  and  technical  assistance  necessary  to  accomplish  the 
interception  unobtrusively  and  with  a minimum  of  interference  with  the  services  that  such  service 
provider,  landlord,  custodian,  or  person  is  according  the  person  whose  communications  are  to  be 
intercepted.  In  practice,  judges  may  sign  two  orders:  one  order  authorizing  the  law  enforcement 
agency  to  conduct  the  electronic  surveillance,  and  a second,  abbreviated,  assistance  order  directed 
to  the  service  provider,  specifying,  for  example,  in  the  case  of  E-mail,  the  E-mail  account  name  of 
the  subject  that  is  the  object  of  the  order  and  directing  the  provision  of  necessary'  assistance. 


Service  providers  and  their  personnel  are  also  subject  to  the  electronic  surveillance  laws,  meaning 
that  unauthorized  electronic  surveillance  of  their  customers  (or  anyone  else)  is  forbidden,  and 
criminal  and  civil  liability  may  be  assessed  for  violations.  Not  only  are  unauthorized  interceptions 
proscribed,  but  so  also  is  the  use  or  disclosure  of  the  contents  of  communications  that  have  been 
illegally  intercepted.  It  is  for  this  reason,  among  others,  that  service  providers  typically  take  great 
care  in  providing  assistance  to  law  enforcement  in  carrying  out  electronic  surveillance  pursuant  to 
court  order.  In  some  instances,  service  providers  opt  to  provide  “full”  service,  essentially  carrying 
out  the  interception  for  law  enforcement  and  providing  the  final  interception  product,  hut,  in  many 
cases,  service  providers  are  inclined  only  to  provide  the  level  of  assistance  necessary  to  allo  w the 
law  enforcement  agency  to  conduct  the  interception. 


6 


5/24/02  Release  - Page 


» >v> 

p-^ii 


| ...  '. ' ^ 


Ci  recent  years,  it  has  become  increasingly  common  for  the  FBI  to  seek,  and  forjudges  to  issue, 
Hj  lip?  <*^eis  f°r  *ntl®  Iff  interceptions  which  are  much  more  detailed  than  older  orders  which  were 

tgjk  ' ■ ; against  “plain  old  telephone  services.”  These  detailed  order,  in  order  to  be  successfully 

-v§|  | implemented,  require  more  sophisticated  techniques  to  ensure  that  only  messages  for  which  there 

ft!  I to  intercept  are,  in  fact,  intercepted  The  increased  detail  in  court  oixiers^  ; 

responds  to  two  facts. 


First,  the  complexity  of  modern  communications  networks,  like  the  Internet,  and  the  complexity  of 
modem  users’  communications  demand  better  discrimination  than  older  analog  communications. 
For  example,  Internet  users  frequently  use  electronic  messaging  services,  like  E-mail,  to 
communicate  with  other  individuals  in  a manner  reminiscent  of  a telephone  call,  only  with  text 
instead  of  voice.  Such  messages  are  often  the  targets  of  court  ordered  interception.  Users  al  so  use 
services,  like  the  world  wide  web,  which  looks  more  like  print  media  than  a phone  call.  Similarly, 
some  Internet  services,  like  streaming  video,  have  more  in  common  with  broadcast  media  like 
television,  than  with  telephone  calls.  These  types  of  communications  are  less  commonly  the 
targets  of  an  interception  order. 

Second,  for  many  Internet  services,  users  share  communications  channels,  addresses,  etc.  These 
factors  make  the  interception  of  messages  for  which  law  enforcement  has  court  authorization,  to 
the  exclusion  of  all  others,  very  difficult.  Court  orders,  therefore,  increasingly  include  detailed 
instructions  to  preclude  the  interception  of  communications  that  lie  outside  the  scope  of  the  order. 
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In  response  to  a critical  need  for  tools  to  implement  complex  court  orders,  foe  FBI  developed  a 
number  of  capabilities  including  the  software  program  called  “Carnivore.”  Carnivore  is  a very 
specialized  network  analyzer  or  “sniffer”  which  runs  as  an  application  program  on  a normal 
personal  computer  under  fee  Microsoft  Windows  operating  system.  It  works  by  “sniffing”  the 
proper  portions  of  network  packets  and  copying  and  storing  only  those  packets  which  match  a 
finely  defined  filter  set  programmed  in  conformity  with  foe  court  order.  This  filter  set  can  be 
extremely  complex,  and  this  provides  the  FBI  with  an  ability  to  collect  transmissions  which 
comply  with  pen  register  court  orders,  trap  & trace  court  orders,  Title  III  interception  orders,  etc. 


it  is  important  to  distinguish  now  what  is  meant  by  “sniffing.”  The  problem  of  discriminating" 

between  users’  messages  on  the  Internet  is  a complex  one.  However,  this  is  exactly  what 

Carnivore  does.  It  does  NOT  search  through  the  contents  of  every  message  and  collect  those  that 

contain  certain  key  words  like  “bomb”  or  “drugs.”  It  selects  messages  based  on  criteria  expressly 

% 

set  out  in  the  court  order,  for  example,  messages  transmitted  to  or  from  a particular  account  or  to  or 
from  a particular  user.  If  the  device  is  placed  at  some  point  on  the  network  where  it  cannot 
discriminate  messages  as  set  out  in  the  court  order,  it  simply  lets  all  such  messages  pass  by 
unrecorded. 

One  might  ask,  ‘why  use  Carnivore  at  all?”  In  many  instances,  ISPs,  particularly  the  larger  ones, 
maintain  capabilities  which  allow  them  to  comply,  or  partially  comply  with  lawful  orders.  For 
example,  many  ISPs  have  the  capability  to  “clone”  or  intercept,  when  lawfully  ordered  to  do  so,  E- 
mail  to  and  from  specified  user  accounts.  In  such  cases,  these  abilities  are  satisfactory  and  allow 
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foil  compliance  with  a court  order.  However,  in  most  cases,  ISPs  do  not  have  such  capabilities  or 
cannot  employ  them  in  a secure  maimer.  Also,  most  systems  devised  by  service  providers  or 
- P^kased  “off  the  shelf’  lack  the  ability  to  properly  discriminate  between  messages  in  a fashion 
diat  complies  with  the  court  order.  Also,  many  court  orders  go  beyond  E-mail,  specifying  other 
protocols  to  be  intercepted  such  as  instant  messaging.  In  these  cases,  a cloned  mailbox  is  not 
sufficient  to  comply  with  the  order  of  the  court. 


Now,  I think  it  is  important  that  you  understand  how  Carnivore  is  used  in  practice.  First,  there  is 
the  issue  of  scale.  Carnivore  is  a small-scale  device  intended  for  use  only  when  and  where  it  is 
needed.  In  fact,  each  Carnivore  device  is  maintained  at  tire  FBI  Laboratory  in  Quantico  until  it  is 
actually  needed  in  an  active  case.  It  is  then  deployed  to  satisfy  the  needs  of  a single  case  or  court 
order,  and  afterwards,  upon  expiration  of  the  order,  the  device  is  removed  and  returned  to 
Quantico. 


The  second  issue  is  one  of  network  interference.  Carnivore  is  safe  to  operate  on  IP  networks.  It  is 
connected  as  a passive  collection  device  and  does  not  have  any  ability  to  transmit  anything  onto  the 
network.  In  fact,  we  go  to  great  lengths  to  ensure  that  our  system  is  satisfactorily  isolated  from  the 
network  to  which  it  is  attached.  Also,  Carnivore  is  only  attached  to  the  network  after  consultation 
with,  and  with  the  agreement  of,  technical  personnel  from  the  ISP. 


This,  in  feet,  raises  the  third  issue  - that  of  ISP  cooperation.  To  date,  Carnivore  has,  to  my 
knowledge,  never  been  installed  onto  an  ISP’s  network  without  assistance  from  the  ISP’s  technical 


. _ ;i^|^^^^,TaOTe^UtotMtte“4e'eChlUcal  ®alowfedge  °f  the  ISP’s  personnel, 

,7  <WH“11’  “d  “ S0“  insla"ces  Nxwftte  for  law  enforcement  ageticies  to 

SUKKrf“%  -i  ^ ^ Nm  of  an  interception  enter.  lie  m 

ate  depends  upon  foe  iSP  perconnel  to  understimd  foe  protocols  and  arehitecfore  of  their  particular 


networks. 


Another  primatj  eonsideratton  for  using  the  Carnivore  system  is  data  integrity.  As  you  know.  Rule 


901  of  the  Federal  Rules  of  Evidence 


requires  that  authentication  of  evidence  as  a precondition  for 


its  admissibility,  lire  USe  of  tire  Carnivore  system  by  foe  FBI  to  intercept  tmd  store 
communications  provides  foran  undisturbed  chain  of  custody  by  ptuviding  a witness  who  can 
testify  to  foe  retrieval  of  the  evidence  and  the  process  by  which  i,  was  recorded.  Petfottnance  is 
another  key  reason  for  preferring  this  system  to  commercial  sniffera.  Unlike  commercial  software 
sniffers.  Carnivore  is  designed  to  intercept  and  record  the  selected  communications 
comprehensively,  without  “dropped  packets.” 


m conclusion,  I would  like  to  say  that  over  foe  las,  five  years  or  more,  we  have  witnessed  a 

^ “ of«™,«,ed  crimes,  inchtding  traditfooaicrimes  and 

teTOnS1  **''"“*  ^ ^ P'“ned  ot  ranietl ««.  Pan,  using  foe  Internet  The  ability  of 
the  law  enforcement  community  to  effectively  investigate  andpreventfoese  crimes  is,  inpari, 

dependent  upon  our  ability  to  lawfully  collect  vital  evidence  of  wrongdoing.  As  the  Interne, 

Itecomes  more  complex,  so  do  foe  challenges  placed  on  its  to  keep  pace.  W.  could  no,  do  so 
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if%  cooperation  of  our  industry  partners  and  innovations  such  as  the  Carnivore 

^ S0|gf'  1 want to  stKSS  ftat  <*»  FB*  &**  not  conduct  interceptions,  install  and  operate  pen 
’••  vsetzaP&  &«»  devices,  without  lawfoi  authorization  from  a coart  ' 


I to*  forward  to  working  with  lire  Subcommiaee  staff  to  provide  more  information  and  welcome 
yonr  suggestions  on  this  important  issue.  1 will  be  happy  to  answer  any  questions  that  you  may 


haw.  Thank  you. 


v- .* 


U 
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. Fire  on  Hill-  * 

:<*.  -■  f 

fyloHsScavAin*  t . • 

gWangwi  hit  Su^f  Writer- 

PoMml  law  enforcement  ofiS* 
^afs  defended  *Cantlvorew-»^be 
rBFfi  controversial  Internet  wixe- 
&P  $y$tem~~ifoough  more  than 
two  acdmamous  hours  ©f  gnSmg 
by  Bemotsratic  and  Republican  taw- 
i makers  yesterday,  painting  a ddlb 
tag  ptdmt  of  ait  .Internet  that 
woaM  become  a safe  haves  for 
' &Oob  and  terrorists  without  prop- 
■or  surveillance, 

v ' vQimfoa&  use  computers  to 
i V&toOqfo  to  each 

i FBI  Assistant 

j Director  Donald  M,  Kerr  told  the 


vfv.^y;  ^ «^««w*we  wawsKwiosi 
“Cfimiaals  use  txmmm  to  send 
ch3tf  fKHrougraphy  to  each  other," 
said  FBI  official  Ponald  M*  K«r. 


f House  Judidary  subcommittee  on 
t the  Constitution,,  "Hadkers  break 
J^lnto  financial  service  compaai^ 
/ SF&ems  and  steal  tmstmncra'feome 
icredit^ard , nw& 

■ bers^  criminals  use  the  Internets 
; fne^pes^ind  easy  comrmimca- 
I tkfcs  to  commit  largeocak  fraud 
* * tfi  ©war  wtfol  and 

r Many of  &e  iawmdkere  seemed 
ts  cpuomied  with  &e  actions 
iofthe  law  enfeoement  offers 
* ^u*e  potential  for  abuse  herelsfre-' 
rnttsdcmf  saM  JR^  Spencer  B*. 
fJjjM pRAk.),  "What  you're  saying 
is  Justus/  % ><**>  vv^w „ 

^Candvore  is  t mo dBc&'vzmm 
program  known  as  a ^packet  sniff- 


Civil  liberties  groups  and  inter- 
net service  providers  say  the  sys- 
tem raises  troubling  questions 
about  what  constitutes  a reason- 
.able  search  and  sefoure  of  dectron* 
ic  data.  fo- sniffing  out  potential 
criminal  conduct,  they  note,  the 
new  technology  also  could  scan  pri- 
, yate  information  about  legal  actiw 
i ties,  taMsg  in  vsst  immunis  of  In- 
formation from  innocent  people  as 
well  as  tbe  suspect 
Hie  aides  also  note  that  past 
^periome  has  shown  that  law  ea- 
(forcemeat  has  overstepped  fe 
' wiretap  authority  numerous  times 
jmthepasl 

| ' ^^  Stemhardt,  associate  <fe 

*tl«6  IT«W  i--*- i 


f^be  d?aity  to  quid#  codec* 
fast  &c  ^to,  sad  *fojja*  informs- 
t»«J  la  e-mail  messages,  for  ear- 
ample,  sod  apt  online  hanking 
toMatS&ms  Tbat.  Urw  e£ 
rforaahwt  the  equivalent  of  the 
jtetepboos  wxMV.'pers  register* 
«d  *ta»  and  baoe*'aat»-the 
| and  destination  of  aB  calls  relat- 

» ed to  the aul^ecL' * ' * 


- ’ vr*x-  w IVtl &iU.J 

a wiretap  capable  of  accessing  the 
easterns  of  the  convemthms  of  all 
fhe  phone  ompmf$  customers, 
wrth  the  'assurance'  fli^  the  FBI 
wSI.tecord  only  conversations  of 
the  specified  . 

Internet  service  pro- 


!-«^^K^5SShS  1 

i publish  ;Monnaiicm  on  die  soft*  { 


..  waft  used  so  that  ISPs  can  be  sure 
I that  it  does  what  the  agency  says. 

The  law  enforcement  officials 
pledged  to  present  the  system  to  a 
neutral  fluid  party  for  review  bat 
said  they  cannot  release  so  much 
information  about  the  system  that 
it  will  become  a target  for  evasion 
and  hacking. 

They  insisted  the  Carnivore  $ys~ 
lem  actua%  provides  greater  prb 
vacy  than  previous  methods  of 
gathering  electronic  Information 
because  it  can  fine-tune  what  the 
machine  hands  over  to  fovr.stiga~ 
tors,  **  ^ 

The  FBFs  Kerr  also  argued  that 
^ents  won't ‘*risk  thdf  integrity, 
their  jobs  and  their  Mures*  hy 
' abusing  the  lam  . 

The  toughest  ouo^oafogcame 
from  Reps.  JerMi  IS  (l> 
N.Y.)  and  Robert  l.  Bair  Jr.  {R. 
Ga.),,two  eoagressmSi  randy  on 
tlie  same  ade  of  an  issue,  tfadter 
peppered  the  olBdals  with  a series 
°f  fjuestioas  that  tmd^r&»re4  &e 
Point  that  Carnivore,  trader  the 
iat^  that  govern  peo-register  sur- 
wsSaooe,  eotdd  be  used  vdtflhoot 
the  diflScdt  showiag  of  ‘pnAabte 
cause*  required  m a tdtohoae 
wiretap.  . 

Barr,  cited  the  ittvesttgadoa  of 
wisstng  White  House  octaS  a»d 
sooraft^y  said  the  CSatoa  adotia- 
rstratioo  asserts  that  ^ don't 
even  know  bow  to  keep  track  of  our 
owa  frmair  while  ‘now  we  see  a ' 


' wpiujw wtw  Kff  Rgro* 

h«  track  of  other  people's  JHiaSaT 
After  the  hearing.  House  Major- 
ity Leader  Richard  K.  Aratey  fe. 
cned  a statement-saying  rowobmi 
of  both  parties  showed  ‘strong 


. numa  ua^mRv 

ptbtectfoa  «g*M  im* 
vranftgted8eai*3t  tod  ^mre. 

. 'Gnti!  these  concerns  are  id- 
'Csniirore 

.«K»uabe  afeatdowa.* 
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Panel-  Debates  Carnivore 


Tt^  Httuts 

' IqMiif  «/  T*m  Wau,  sWr  *«  *N‘At 

s rf  Federal  Hureau 

tended  its  Carnivore  In- 
term-Wftabnce  software  to  a largely 
«epoet}  congressional  oversight  panel, 
telling  lawmakers  that  the  electronic 
• system  is  used  only  wiien 


(oWvPfii 


rs 


tyifr&gz  and  needed  to  protect 
citizens  from  criminate  and  terrorists* 

~ ™ enfc,  the  FBI  yesterday 
anaatmeed  a new  tamperproof  auditing 
mechanism  lor  Carnivore  that  it  said  will 
$I*ow  federal  judges  and  others  to  review 
curing:  each  investigation  how  the  system 
motors  a suspect's  e-roaii.  And 
me  FBI  said  it  plans  to  show  Camivore’s 
y workings  to  an  organization  that  it 
|5tl  select  toprove  that  the  system  works 
m as  described  by  the  government 
^ Members  of  the  House  Judiciary  Sub- 
® mmittec  on  the  Constitution  pressed  FBI 
arid  Justice  Department  officials  yester- 
day to  prove  that  only  e-mail  and  other 
Ipter-Bet  communications  from  criminals . 


"T1  w*»  ,«*w  use 

CKnmitteC;ttold  them,  *You  can  un-  i 
oemaad  the  s5d$i$kuess"  of  some  people 

■** 


T ivi  nereis  tremen-  ; 

dous^dan-t  yuo  agree?'  added  Rep.  Spen-  * 
«?rJ»dRs  CR^. Ala-1-  - . ■• .. ; . - 

f .g!*esg  Vtism’i  agree 
m^  tqaieg  gBi  General  Oaunsel 
And  Donald  Sot.  head 
tftteFBI-tahoratory  whereCantivore  was 
develop^,  added  that  the  B&twait*s  use  Is 
#»«,»  intemai  reviews,  and 

be  a fetaiy  *We  don't 

. ^^Opia^'q^ia^i^  -if 
everybody  wouldn't 
there  fe  a gtat- 
^mfiagfrafetej,  feat  would  reduce  a 
jrrf^effijrts.*  Bm  after  l,fr;Kterof- 
e^toeea  that  Cared  we  captures 
dg^teli&rfjsaditm  it  Is  programmed  to 
iffa*  wtfW*  *f  don’t  know 


nntnwtiiwt  ' ' ' vT  ■ ” < 


maintains  Unit  un  mwn!  is  kept  of  my 
wtrelaled  messages  sent  by  imweent  cus- 
tomers of  the  same  Internet  provider,  The 
FBI  im  used  the  system  IS  times  so  htr 
this  year*  m six  criminal  cases  and  10 
natfanabsocurjty  investigations* 

Critics  complain  that,  since  hie  govmi* 
mem  refuses  to  disclose  die  btoepnnte  for 
how  its  software  works,  there  is  tittle  as* 
stir&oce  that  the  mt  snooping  isn't 
broaden  The  American  Civil  Liberties 
Onion’s  associate  director,  Barry  Stein- 
hardL  testified  that  the  system  is  "roughly 
the  equivalent  to  a wiretap  capable  of  ac- 
cessing the  contents  of  the  conversations 
of  alt  of  the  phone  company’s  customers 
with  the  assurance  that  the  FBI  will  record 
only  conversations  of  the  specific  target/ 

The  panel  discussed  opening  Carni- 
vore’s blueprints  for  review,  which  the  FBI 
adamantly  opposes*  Even  then,  said  Hem 
Jerroid  Nadier  CD**  Nl),  civilian  experts 
could  he  guaranteed  only  that  they  were 
looking  at  die  current  version  of,Carah 
vore,  which  is  oontimialiy  being  upgraded 
and  modified.  *It  'could  change  at  any 
time-  You  can’t  trust  a police  agency  for- 
ev^.he  said.  X ,-'  . M . \ 

vdli  allow  o^puter  hs^e^stofel 
ways  to  defeat  the  system,  and  he  won* 

b&ehed  far  r^vfau:'*WA  «ws ink 


said-  /‘When  is  enough  enough?’* 


»Ari:_H£yf 
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Ffe&rag  law  enforcement  agents 
say  they  have  used  the  controver- 
sial Carnivore  software  program 
to  track e-mail  of  suspects  25  times 

m the  pas^  fwo^years^ 

Bat  agents  have  never  used  the 
program  illegally  or  tracked  e- 
mad  they  were  not  authorised  to 
track  by  a court  order,  FBI  Assis- 
tant Director  Donald  Kerr  told  the 
House  Judiciary  subcommittee  on 
the  Coasdto&on  yesterday 
De^fte  the  restraint  the  FBI 
says  it  has  used,  privacy  rights  ad- 
svoc^cs^cntidxea  law  enforcement 
using  Carnivore  and 

ienfs  use 

,ce tool 

, Leader  Dick 

to^Republican,  said 
^“-ivore  should  be 
^DUcerns  of  pri- 
^-—■‘'and  needs  of  Law; 
ttoraropciled,  v 1 
Vtf&scmts  are  ad-  , 


il&qifens* 

* crucial  to  help 

■ crimes  that  we 
ay  to  the  ph^ 


. to  appear  on 
.Assistant  At- 


But  lawmakers  expressed  con- 
cern about  a lack  of  checks  and 
balances  on  law  enforcement 
agents  using  Carnivore. 

’"Hie  potential  for  abuse  here  is 
enormous,”  said  Rep.  Spencer, 
Backus,  Alabama  Republican. 

FBI  General  Counsel  Larry  Par- 
kinran  said  Carnivore  is  a little- 
used  tool.  When  it  is  used  Mr  Kerr 
sMd,  agents  follow  the  iaw 'care- 
fully, and  if  they  are  caught  collect- 
ing more 'data  than  allowed,  they 
can  be  imprisoned  up  to  five  yearn 
for  committing  a federal  felony. 

"In  the  past,  we’ve  had  many 
agencies  go  beyond  the  scope  of 
; *eir  authority,”  said  Rep.  John 
\ uapyers  Jr,,  Michigan  Democrat 
Mr,  Kerr  said  the  FBI  and  De- 
Justice  mil  seek  an 
independent  review  of  Carnivore 
this  mr  to  show  they  aren't  rms- 
using  the  program. 

Lawmakers,  and, privacy  rights 
^so  btit ie&ed  federal 
omaals  for  using  Carnivore  when 
Internet  service  providers  could 
just  as  easily  collect  information 
being  sought 

- .P*?*  °u^ht  to  be  more  control 
m the  hands  of  the  {Internet  ser- 
vice  providers!;'  said  Alan  David- 
son, a lawyer  with  the  District- 
based  civil  liberties  group  .Center 
tor  Democracy  and  Technology, 

Mr.  Kerr  argued  that  few  of  the 

**at*onfc  estimated  10,000  Internet 
service  providers  have  toe  means 
to  sjft  tarou^  e-mail  traffic  and 
«Uecttoem for  law  enforcement 
But  Robert  Cem-Revere,  m at- 
watJW  who  represented  Atiante- 
Internet  service  provider 
Earthlink,  said  EartbLaOc  was 
e-raml  information  at 
^federal  government*  request 

earlier  


to  ?tomp|y  & com  order  and 
set  federal  officials  install  Carrn* 


vore  on  its  computers, 

Tht  federal  government  was  up- 
set that  Earthlink  was  capturing 
f?w  messages,  Mr;  S 

5E<SSitnee<llessiyte* 

■ , Am^ncan  Civil  libeities  Union 
Assomate  Director  Barry  Stein- 
hardt  suggested  Carnivore’s 
source  code  be  made  public.  The 
source  code  is  the  set  of  instruc- 
aons  a programmer  writes,  and  It 
will  show just  what  Carnivore  is 
The  ACLU 

iias  Sled  s 


Act  request  with  the  FBIto  S 
source  code.  ■■ 

^ea  though  they  had  a raft  of 
questions  about  Canavore  and  its 
use,  lawmakers  yesterday  didn’t 
express  any  willingness  to  make 
immediate  changes  to  the  federal 
government's  authority  to  use  the 
surveillance  program,  , 

"We  should  be  sensitive  to  any 
potential  for  abuse  of  the  Ca rm- 
vore  system.  Even  a systcnTde- 
WBied  with  the  best  of  Intentions 
to  legally  carry  <*  * essential  law 
enforcement  functions  may  be  a 
cause  for  concern  if  Its  use  is  not 
nptotored,"  said  Rep, 


• tf*. 
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July  26, 2000 
John  Kelso  Jr. 

Federal  Bureau  Investigation 
Chief,  FOI/PA  Section,  Rm.  6296  JEH 

Washington,  D,C.  20535-0001 

Office  of  Public  Affa  irs 
" United  S tates  Department  of  Justice 
Room  1128 

950  Pennsylvania  Avenue  NW 
Washington  DC  20530-0001 

Attention: 

We  are  writing  pursuant  to  the  Freedom  of  Information  Act  (5  U.S  C S 552)  to  reouest 
expedited  handling  of  our  July  14, 2000  request  for  all  agency  records  'Stem 

ZSfTl  ^ n0(eS’  ^memomtda,  email,  computer  so^T 

ihl  pw  f ’ t('chn3caJ.f1ianuals>  technical  specifications,  or  any  other  materials)  held  by 
the  Federal  Buieau  of  Investigation  (FBI)  regarding  the  following: 

1.  The  computer  system,  software  or  device  known  as  ''Carnivore",  which  has  been 
or  is  currently  used  by  the  FBI  in  connection  with  trap  and  trace  and  pen  register 
orders  served  on  Internet  Sendee  Providers  or  in  connection  with.ordem  forJhe 

m Perception  of  the  content  of  electronic  communications  served  on  Internet 
service  Providers;  

2.  The  computer  system,  software  or  device  known  as  "Omnivore",  which  has  been 
or  is  currently  used  by  the  FBI  in  connection  with  trap  and  trace  and  pen  register 
orders  served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the 

int  erception  of  the  content  of  electronic  communications  served  on  In  ternet 
Service  Providers,  and 


* ' ♦■S',. 

a.  The  computer  system,  software  or  device  known  as  "EtherPeek"  which  has 
or  is  currently  used  by  the  FBI  in  connection  with  trap  and  trace’and  pen  rogS 
orders  served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the  ‘ 
interception  of  the  content  of  electronic  communications  served  on  Internet 
Service  Providers.  . 

We  seek  expedited  review  of  this  FOIA  request  because  this  information  relates  to 
impending  policy  decisions  to  which  informed  members  of  die  public  might  contribute. 


Stress***  Prvz&gni 


Ira  OtmamSvKiM/eOmgor  Kmnettt  B.  Cfa*  Cm.  (msmiAmoiyGm/net 
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' • access  to  these  materials  is  necessary  to  fbllv  inform  if,*.  > t-  , 

' maes su^oundine communications f **  PubIlc about the 

,.§^7  ^ 8 commut?Ica{,°^  interception  and  related  technological  developments. 

Specifically,  wc  request  expedited  access  pursuant  to  28  C F R 16  Vd¥i  VilY  wKir-n 

allows  such  processing  based  on  an  “urgency  to  inform  the  niihiie u ' ' ^ 

aliened  Government  ;t  a . y miorm  the  public  about  an  actual  or 

*'  information.*'  As  evnlnm^  f,  d<i  b^aferson  primarily  engaged  in  disseminating 

government's  use  of  Carnivore  is  a matter 

to  protect  M « 

- has  been  so  strong  that  (W«  has  ISt  £?  Sf  PfI,C  f***  aboUt  Camivo^ ' 

(See  OMr  fU*S? Tf  7 “ at  *“*  one  heari»S  « «*  subject 

Program  “ 306th  Cbn/f20nm  V*  * Ae‘^ment hsues Raised the  FBI’s  ‘Carnivore’ 

* SSS':  J? % (2000>-)  A *****  Congressional  hearings  and  slew  of  press 

■>000  atAl  -nu  u 0p?°SeFB1  Scrutiny  Of  E-Mail,”  Washington  Post,  July  21 

“Fveinwr  Pt  i I?pper>  EatIng  Aw*y  a{  Privacy?”  Associated  Press  July  J2  of)QO* 
Eyeing  High-Tech PnvafeEyes”  ABCNews.com,  July  14  2000-  - 

will  not  devour  privacy  “ CNN  com  j«iV2i  *> onn\*  !,  -FBI  says  Carnivore 

' Mail  ‘Carnivore”’  PC WoTeoZ^lSf  “ * 

Mweovcr,  the  American  Civil  Liberties  Foundation  (ACLU  Foundation!  meets  the 

TO™ntiri7f  u e al‘0nal  7*1'  T**  *•  DePartm®*  °f  Defense,  where  a 
representati  ve  of  the  news  media  is  defined  as  an  entity  that  "gathers  information  of 

potential  interest  to  a segment  of  the  public"  and  "uses  its  editorial  skills  to  turn  raw 

mr £.'  ACL,  ,‘p ' ’T*’  and  dis,rita"s  ,ta  «■*'  “>  - «*•» ■ m f m l 
bri!L«  nohho  LF°“  a °!!  Ptl,sh's““vstel«- f'«mml  press  releases,  news 
public  Tts  material  iTwidetv  C-fi?*  °<,,er  fflaten2ls  11)21  are  disseminated  to  tire 
not  for-profit  groups. 

mv.aciu.org  as  well,  I bus  the  organization  meets  the  pertinent  reeuhtfmr 
requirements  for  expedited  access.  P ieyiUtory 

In  addition  we  request  expedited  access  pursuant  to  28  C.F.R  16  5fd)«¥ivl  which 
allows  such  access  for  a “matter  of  widesnrp-i/t  , ' \ h ^ nicn 

there*  evtcf  tvu»;K!e.  , • V " ,acsPrca<1  an«  exceptional  media  interest  in  which 

there  exist  possible  questions  about  the  government’s  integrity  which  affect  nublir 

nfidenee.  Again,  the  recent  Congressional  hearings  as  well  as  the  storm  Af  a* 
joverege  aitou,  Carnivore  and  re, aied  computerprej^  StptTvil^d,. 
wde^read  and  exceptional  media  interest”  in  .his  issue.  Moreover 

We  have  enclosed  certification  (for  the  pmposes  of  expedited  access)  with  this  letter. 


S/24/02  Release 


Jo  your  reply  within  ten  calendar  days,  as  required  under  28  CJ 


I6.5(d)(4)^’ 

Tlianlc  you  for  your  assistance. 
Sincerely,  . 


B^^StSM^CEsq. 

Oa behalf  of  the  ACLU  Foundation 
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% ' CERTIFICATION 

To  whom  it  may  concern: 

beffiT' ^ r0“°'Vi"S  6C‘S  “ lmc  a"d  C0TCC1 10  *•  ta.  of  my  knowledge  and 


1 * j f e Axeman  Civil  Liberties  Foundation  {ACLU  Foundation)  meet* 

out  a National  Security  Archive  v DeoartmL  of n.r™.  i ’ “ cntenon  ,,,d 

news  media  is  defined  as  an  Mi  Jih7»SZf  w!  a of  . the 

FoiSn  pSSSSSi0  88!  R 2d  a*  1387-  «“  ACIU 

handbooks,  md  other  materials  that  neWS  bnefiaSs>  to  fe»w 

“ £ TT'****  te  W «»■**-*  n^-p!ofi“  ’ al  y 

students  and  faculty  for  no  cost  or  for  a nominal  fee  through  its  public  education 

epartment.  The  ACLU  Foundation  disseminates  information  teough  publications 
available  on-line  at  www.aclu.org  as  well.  publications 


Fhc  disclosure  of  Informahon  t 
die  interest; 


» regarding  the  following  computer  systems  is  In  the 


Ihe  computer  system,  software  or  device  known  as  "Carnivore’',  which  has  been 
“f  * ,h%m  “ "--ft  top  and  toco  aud 

interceofion  ftni  ^'r  T Fl0v,dcr$  or  OT  connection  with  orders  for  the 

Se^e  PmvideS  * ^ communicationS  served  on  Internet 


The  computer  system,  software  or  device  known  as  "Omnivore",  which  has  been 

ZZlZTjf  US? ?y  ih%m. COm,cc!ioil  with  traP  «**  trace  and  pen  register 
orders  served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the 

£T  °[CkCirQnk  ^ « Internet 


Hie  computer  system,  software  or  device  known  as  "EtherPeek”,  which  has  been 

Uf  1^  lhf Bi  " With  **  ^ trace  and  pen  Se" 

orders  served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the 

Pr^ddexs6  C°ntent  °f  eleCEr0n‘C  ^^^umcations  served  on  Internet 

Records  regarding  Carnivore,  Omnivore  and  EtherPeek  are  likely  to  contribute 
significantly  to  foe  public  understanding  of  the  activities  of  the  government  ^ ACLU 
Foundation  is  a nonprofit  501(03  research  and  education  org ^tioTwoldngl  ° 

increase  citizen  participation  in  governance  issues.  The  ACLU  Foundation  k mat-mo  u ♦ 
^quest  speci  fically  for  the  public’s  enJianced  understanding  of  lawfully  authorized  § 
ire  appmg,  its  relationship  to  constitutional  guarantees  of  privacy  as  well  as  an 
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Web.  Uesc  **  ^ ^ Worid  Wkte' 

■ * worid- « ssrar 

iaierest  wHch^SS^So^?l“lO!!lf^d  “4  exc'Pl»nal  media 


Congress  ha*  lw7J  . * ' ® camivore  grown  to  such  an  extent  that 

~3f*Tr*  il?'d  at  least  one  heann§  «a  tins  subject.  (See  Oversight  Hearing 

POM 'Carnivore' Pro fam  ^3*£* 
(*000)  )_  The  tremendous  amount  of  media  coverage  about  Carnivore  and  related  S' 
computer  programs  also  provides  strong  evidence  of  the  “wirWn  » a a reJatfid_ 
m=dia  inter  i„  this  uL.  (See.  c g lota S , Z?? Z* 

SSSi Washmyon  Poa,Ju]y  21.2000  al  Al;  D Ian  Hopper,  •t=,^., 
A,vny  at  Pnvacy  Assorted  Press,  July  12, 2000;  “Eyeing  High-Tel  Prtvte  fis  » 
ABCNews.com,  July  14  2000*  “FBT  save  r«™t«  -t.  6 . iCUl  i mare  byes, 

July  21 , 2000'  Margaret  Johnston  '45n°  2 It  W?,L 10t  devoor  privacy,”  CNN.com, 

Jtli'  , CI\,  Tiv  S(on*  FBI  Dcmos  E-Mail  Carnivore’,”  PC  World  com 
Ju*>  t 1 ’ 2000-> 1,1  ad^tion,  the  requested  materia!  mav  provide  HKwor-  ,1 
questions  regarding  the  oovemmrntv  „»ir  ",  p . answers  t0  senous 
liberties.  government  s willingness  to  protect  individual  privacy  and  civil 


Barry  Steftjjhardt,  Esq. 

On  behalfof  the  ACLU  Foundation 


<? / tyvt 


July  26, 2000 
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Diagnostic  Tool 


^%5sSiS^S^E^  ®^k  Statement  for  the  ' " 

sskb^sp**^  . 

ac&vtSes^^  ■ * 8 ^°romun*catons  to  plan  and  execute  their  criminal 

S aS?g eSfenS  5 ^SlSSS^SSSbeKS&^u  *S^' *?^o^t«5SSSe» 

subject  to  being  discredited  or  imoeached  thm.1 aK«;£^^!n® !ha,can  b® 


based  upon  a dMMk^ '££?  " **  t0  ***** factua!  issues 

D^artmem  of  JustSpo^ 

^h!edarf  mm  court  judg'Jor 

p ion  of  communications  is  limited  to  certain  specified  federal  felony  offenses.  ’ 

S5^  Probabfe  cause  and  state  with 

or  place  from  which  theSbject’s  commumSonsSote  imeSiSmUrf iCSt^ facMty 
the  types  of  conversations  to  be  interceoted  and  ih*  ne<C.t°e0, a ckscnption  of 

lam  focus  on  jalhorfns  ham  evkfe ra  - not?te%SS.^  elWroniC  s“’v»l8aiKe 

SSSTS“  Stt2^  •“’“I®*  *»  not  wort,  of am 
resanlins  Bis  subject  or  facility*  qLstto  cSmSSSSSLtS^  "ve*TO8 
interceptions  must  terminate  LnS» CoKSS  SJSS*  »"<* „ 

P™8»®  of  KteSSJSS  JS? ml?iSsttSUS^0|teS,  “S*1"*’!8  01  “» 
peRndted,  « justified,  for  up  to  a period  of  30  days.  ™ application}  are 

**  c2ffcti0n  of  "*** 

for  electronic  surveillance  as  the  evidence  cannot  hnJshf^Yt  °fS8sJbere  *®  no  substitute 
investigative  techntaueT  enC0  030,101  te  obtatnecf  other  traditionai 


5 S ^""S”1  lwes88aiions 

communicate  with  |JS ta£S sS&Tp otlwr  or  10 

Cami““  ^.^idss  the  FBI  with  a -surjicaF  aWByto  intern,*  and  coBacf  the 
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aSr . *hv>vwv.?v,v- 

Ps  ■'•'«?•  -^.W':*  ••*>  ■ 

♦ atop  Carnivore 

+?**■<  f£»rv-- '■■ 

ife.  ‘ . 


Stop  Carnivora 

My  27, 2060 


Mi/ 


JS1 R^Sf re,0f  Consref  sent  *»  followln3  tett9r  to  Attorney  General 
Janet  Reno  asking  her  to  suspend  operation  of  the  Carnivore  internet  ” 

addressed8  S^Slem  Unlil  the  se,tous  P^acy  issues  Involved  have  been 


Congress  of  tfjc  MmtcJj  States 

2Sfo$bmgtcf!(  JBC  20515 
July  27,  2000 


The  Honorable  Janet  Reno,  Attorney  General 
US  Department  of  Justice 
950  Pennsylvania  Avenue,  NW 
Washington,  DC  20530-0001 


Dear  Attorney  General  Reno, 

syst JSSJS^: m0ait0®g 

enforcement  are  essential  priorities,  Carnivore  has  raised  serious  Fourth  Amendment 
***  *****  g0Veniment  be  Ctustod  this  kind  of  personal 

continSTJ^f dCnC€  k mervfy^d  security  of  the  Internet  am  essential  for 
is  not  reading  tteir  cmadZm“terhow  woShy  “obMvf* ^ E°VOTm“lt 

Carnivore  could  have  on  consume  confided  fa te fataS? 

any  activity  involving  the  development  or  use  of  Carnivore  until  the  Serious  nrivacv 
issues  involved  have  been  satisfactorily  answered.  ^ ^ 

Sincerely, 


httpy7freedom.house.gov/iibra5yr/technology/camletter.asp 
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-c^r  * 

. stop  Carnivore 

W-'  • .. 

,i*  • 


. . .,•  Dick  Armey 

mmi 

pjj^Pl^  Kevin  Brady 
Jack  Metcalf 

:S' 

. Charlie  Norwood 
Nancy  Johnson 
Richard  Pombo 
Sonny  Callahan 
Tom  Cobum 
Charles  H.  Taylor 
Dan  Miller 

Additional  supporters: 
Cynthia  McKinney 

Ron  Paul 


O 


Doc  Hastings 


Related  Links 

The  e-Cofitra^ 

temstto  on  the  e-Cpwrprf  wilh  High  Tech 


Tom  DeLay  , * 
John  Thune 
Brian  Bilbray 
Bob  Barr 
Jim  McCrary 
John  McHugh 
JtmKolbe 
Richard  Baker 
Mac  Thomberry 


J.C.  Watts 

• j ■ . •••  • 

Larry  Combest 
Julia  Carson 
Bill  Archer 
Terry  Everett 
Tom  Campbell 
Donald  A.  Manzullo 
Zach  Wamp 
jim  Gibbons 


Bob  Goodlatte 


Freedom  Works  : 


WOT  ftS 


Page  2 of  2 • 


http^/freedom.house.gov/library/technology/camletter.asp 
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Wm*  to  s**wf  8*$  story  to  another  AQL  member ? Click  on  the  heart  at  the  top  of  this  w'mtow. 

^no  d^rilS  FBI  Infemet-wlretap  system  review 

££Sjgp^:~v : • ■ ■■■'■ 


WASfflNGTON,  My  27  (Reuters}  - U.S.  Attorney  General  Janet  Reno  described  on  Thursday  a two-step  process  to  review  a 
new  FBI  Wemef-wiretap  system  called  Carnivore  that  has  raised  privacy  concerns. 

* <iy  -•»*■  • ¥ -w  • >a  . ^ * » . . . 

With  lawmakers  and  privacy  advocates  concerned  the  system  allows  for  widespread  surveillance  of  e-mails,  Reno  said  the  first 
step  will  be  for  a group  of  academic  experts  to  conduct  a detailed  review  of  the  computer  program's  source  code. 


"Those  experts  win  report  their  findings  to  a pane!  of  interested  parties,  people  from  the  telecommunications  and  computer 
industries,  as  well  as  privacy  experts/  Reno  told  her  weekly  Justice  Department  news  briefing.  . ..  *&»%'  - 

"Tm  very  anxious  to  get  this  review  under  way.  The  FBI  is  working  on  It,  and  representations  of  the  bureau  are  meeting  with 
privacy  advocates  and  representatives  of  the  telecommunications  and  computer  industry  to  pursue  it  and  to  develop  a protocol  fo 
the  redew/  she  said. 

The  system  allows  the  FBI  to  intercept  the  e-mails  of  a criminal  suspect  among  the  flood  of  ©therdata  passing  through  an 
Internet  sendee  provider. 

FBI  officials  maintain  the  court-authorised  wiretaps  will  only  focus  on  criminal  suspects  who  are  targets  of  an  investigation.  But 
privacy  advocates  fear  the  system  may  cast  too  wide  a net,  encompassing  private  information  about  legal  activities, 

Reno  said  the  two-step  process  was  worked  out  with  the  FBI,  and  that  she  wanted  the  review  to  be  done  "'as  soon  as  possible/ 

She  said  the  system  would  not  be  suspended  until  the  review  has  been  completed.  T think  that  we  will  continue  to  make  sure 
that  it  is  implemented  carefully  and  there  is  no  abuse  in  its  use/ 

fn  a letter  to  Reno,  27  House  of  Representatives  Republicans  and  one  Democrat  expressed  ""strong  reservations*  about  the 
system  and  urged  Reno  to  halt  its  operation  "until  the  serious  privacy  issues  have  been  satisfactorily  answered/ 

The  lawmakers  added,  "‘People  should  feel  secure  that  the  federal  government  is- not  reading  their  e-mail,  no  matter  how  worthy 
the  objective,* 

Reno  stopped  short  of  agreeing  to  release  the  source  code.  The  American  Civil  liberties  Union  has  asked  for  it  to  be  made  publi 
so  it  could  evaluate  the  software's  true  capabilities, 

14:06  07*27450 

Copyright  2000  Reuters  Limited,  Ah  rights  reserve#.  Repuhflcation  or  redistribution  of  Reuters  content  including  byframhg  or  simiior  means,  /s'1' 
expressly  prohibite#  vtithout  the  prior  written  cm sent  of  Reuters,  Reuters  shelf  not  be  liable  for  any  errors  or  delays  in  the  content  or  for  any  actions 
taken  in  reliance  thereon.  All  active  hyperlinks  have  bwn  inserted  byAOL 
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||m.  to  smb  this  story  to  another  AQL  member?  Click  m the  heart  at  the  top  of  this  wmtew, 

B ^^^Addresses  E-mail  Surveillance  . 

|||  '%  fho  Assodateb  Press  . . / . 

m : * 

iff  WASHINGTON  (AP)  * A move  is  under  way  in  Congress  to  increase  the  burden  on  federal  law  enforcement  agencies  to  justify 
jv|k  monitoring  people*  e-mail  messages  and  other  communications.  1 

8 Rep.  Boh  Barn  eonffmted  that  he  and  his  staff  are  at  work  on  a bill  that  would  ran  in  the  FBI’s  new  ‘'Carnivore*  surveillance 
system  and  place  additional  restrictions  on  telephone  wiretaps  as  we#. 

Barr,  R-G£,  said  he  was  concerned  about  computer  eavesdropping  capability  before  attending  a hearing  on  Capitol  Hill  earlier 
this  week,  and  he  said  he  "came  out  of  it  scared.* 

v Privacy  advocates  and  computer  experts  called  Carnivore  a "black  box*  in  testimony  Monday,  and  said  only  the  FBI  knows  whal 
v n <*»«-  'Hwy  also  contended  that  information  the  FBI  gets  from  the  device,  installed  at  a suspect*  Internet  service  provider, 
* is  for  more  than  what  could  be  gleaned  from  a telephone  wiretap  and  statutes  governing  telephone  surveillance  are  being 
misused. 

.•  h 8 f®lepf»bne  "trap-and-trace*  or  "pen  register*  wiretap,  authorities  can  get  a fist  of  phone  calls  made  to  and  from  a certain 
telephone  number.  The  usable  Information  is  limited  to  the  10-digit  telephone  numbers  and  the  time  of  the  call,  and  the  phone 
company,  when  given  a court  order,  provides  the  information. 

Current  taws  and  Judicial  precedent  say  that  the  numbers  a person  diais  are  not  private  communications,  and  therefore 
authorities  do  not  need  to  show  that  a crime  has  been  committed. 

With  Carnivora,  that  statute  is  being  extended  to  the  Internet  world. 

v , 

The  details  of  Barr's  bill  aren’t  clear  yet,  but  he  said  it  wouid  address  the  issue  of  translating  telephone  wiretap  law  to  the  Internet 
by  designing  strict  constraints  for  monitoring  the  medium.  It  would  also  make  sure  that  evidence  gained  from  an  e-mail  tap  would 
not  yield  more  information  than  a similar  court  order  for  a telephone  tap.  f 

The  FBI*  new  surveillance  mechanism  sits  at  the  subject*  ISP  and  scans  the  addressing  information  coming  from  or  going  to 
the  suspect*  computer.  This  can  reveal  for  more  information  than  a simple  e-mail  address,  such  as  a subject  line  describing  the 
contents  of  the  messaga 

"Capturing  internet  origin  and  destination  address  instead  of  hum  hers  dialed’  could  create  a much  more  intrusive  form  of 
surveillance  that  is  not  clearly  supported  by  law,*  said  Alan  B.  Davidson,  staff  counsel  at  the  Center  for  Democracy  and 
Technology. 

£ ~ ■ . •,  ...  ' ^ 

Fa-  authorities  to  be  able  to  request  e-maii  contents  they  must  show  probable  cause  and  obtain  a search  warrant.  The  same  is 
i true  for  listening  in  on  a telephone  call 

V 

Regarding  the  inner  workings  of  Carnivore,  the  FBI  Is  resisting  a Freedom  of  Information  Act  request  by  the  American  Civil 
t liberties  Union  for  Carnivore*  computer  code,  but  said  It  will  submit  to  an  externa!  review.  ' ■ 

Smce  the  Carnivore  computer,  devoid  of  keyboard  and  mouse,  sits  at  the  suspect*  ISP  and  is  locked  down  from  any 
manipulation  from  non-FBI  personnel,  Internet  providers  have  bristled  at  the  Idea  of  Jetting  it  sit  on  their  networks. 

Donald  M.  Kerr,  assistant  director  of  the  bureau*  laboratory  division,  said  in  an  interview  that  the  FBI  would  love  to  have  the  ISP 
proude  the  information  authorities  need,  but  the  cost  and  technical  knowledge  can  be  prohibitive  for  small  Internet  companies. 

Peter  William  Sachs,  a lawyer  and  president  of  iCONN,  a small  Internet  provider  in  Connecticut,  sad  the  Job  could  be  done  with 

two  tines  of  computer  code,  and  called  it  a "trivial*  task.  
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^mctHKmBeS,  not  satisfied  with  the  FBfb  explanation," 

ha\e  a stiff  challenge  jn  keeping  apace  of  the  changes  in  technology. 


i monitor  (Mnatis,  Kerr  said,  but  it  a!so  can  monitor  Web  browsing,  chat  rooms  and  ail  sorts  of  other 


1 agument  that  although  Carnivore  can  read  those  things,  ills  a difference  between  "capabiiity  and 

auoWBjMfibn,"  Ketr  vahters-  .•  ? ->u>.  ■ , , ...  . - ^ / 

■ '■*&;: :,.,  . ...  '..  •'  '■'■■'  ' - , - * * 

'£<w-  •£•■•>'  ?%;■  .v^m  • .'  ; 

People  seem  to  conjure  up  this  vision  that  FBI  personnel  are  unsupenased  and  unconstrained  in  the  use  of  these  tods  * he 

th8S8  af’orfUes  to  00  outsfde  {he  sc°Pe  of  court  order  is  to  commit  a federai  felony.  It’s,  to  me  not 
of  our  ^^oyeesvrouid  run  that  kind  of  risk  in  doing  their  jd)*  ' ’ 

“ ***** **  c‘""i''”  ,h“  k“ps  teck  °,i,s  **  <**«***«■ •« •»  •«  wi 

Barr  said  he  expects  resistance  from  other  legislators,  even  from  other  Republicans,  but  said  he  will  not  let  the  FBI  oo 
,.  unchecked  ' w 

"They  want  to  fust  go  out  and  rely  on  scaring  people  to  death,  that  if  they  don't  get  this  authority,  the  terrorists  wil!  take  over  the 
. ,r  country,  and  say  WeVe  out  to  save  the  world,*  * Barr  said. 
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^P‘  C?nrfdy  Introduces  M to  Update  Wiretap  Lawses-® 

^^aijs  an^  Stored  Internet  Communications  Would  Be  Covered  ^ 

WASHINGTON,  D,C.  — Rep.  Charles  T.  Canady  (R-FL)  Chairman  of  fee  wn»<*  t a-  • I 

Subcommittee  on  the  Constitution,  today  introduced  the  Eletfrnnk  r - House  Judiciary  j 

2000.  The  bill  would  update  the  federal  wireti  laws  to  SS!  Cornmumcahorrs  Privacy  Act  ofj 

communications,  as  well  as  provide  a«taX£lV!  ? m”‘  “d  stored  e,ectronic 

addresses  Canadv  k * 5’!Cia  re<5Uirexnents  tor  government  tracing  of  e-mail 

addresses.  Canady  ts  joined  by  original  cosponsor  Rep.  Asa  Hutchinson  (R-AR). 

This  legislation  helps  move  our  federal  wiretap  laws  into  fh* '♦let  r*a  # a 

said.  “We  have  entered  a new  a***  wkh  tur  * P . m*° the  iist  Centur>'*  Canady 
..  : wwrea  a new  age  with  the  Internet,  and  we  need  a new  law  «*  jl 

(he  rapid  changes  in  technology.  While  this  legislation  does  not  answer  anThedmW. 
issues  raised  by  recent  technological  advances  it  does  nrnvid.  r„  “ diflicult 

reforms  that  will  - “ auces» 11  aoes  provide  for  some  reasonable 

reiorms  that  will  protect  the  privacy  rights  of  Americans  ” 

Earlier  this  week.  Rep.  Canady  chaired  a Constitution  Subcommittee  hearing  fin  Fnitrti,  * ^ 

issues  raised  by  the  FBI’s  “Carnivore”  program  The  pm  a,,-  a hf?ng,on  Fourth  Amendmcnt 

isolate,  intercept  and  collect  comm“icariS«„e  2\ ^ developed  Carnivore  to 

24ft  hearing  featured  wite«T!i  r "*  su^lec*  <*  WH  court  orders.  The  July 

. witnesses  from  law  enforcement,  civil  liberty  organisation*  ««»«, 

organizations  and  representatives  from  the  business  community.  ^ P y 

bill  summary 

*«  _ W*  * 


— v*4u*  ***v  awuem  axnc 

^fcchrinic  c®municati^^d7l^alfy^fth»d^tMedefechw^  ■ 

simnlv  arfite  * 6 3 ;wwmco  siorea  electronic  communications.  The  bill 

snnpiy  adds  electronic  communications  to  !he  previously  covered  wire  and  oral  communication. 


that,  tfa  pen  register  or  trap  and  brace  device  is  used  ft  ideurify  an  e-mSSSs! £ 
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vjfe31  S<>vej^aent  must  first  demonstrate  to  a court  that  “specific  and  articulable  facts  reasonably 
crime  has  been,  is  being,  or  will  be  committed,  and  information  likely  to  be  obtaine 
and  use  [of  a pen  register  or  trap  and  trace  device]  is  relevant  to  an  mvestigati. 


Fof  * copy  of  Rep.  Canady’s  legislation  (7  pages)  please  call  Michelle  Knott  at  (202)  225~12S2> 
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SHBWte  *&'  i4&$£$g  ^$a§ua^.  * 

^HJgro  W^'-Att  5ts:«ccmly  'disposed 
Intcraec  surveiltece  system  is  iaot 
a y^'Sp^ctruin  thxt&t  to  privacy.  Federal  00* 


S to hying to foroe a 

n ■■  . ^ 

J ytot  JS  authorized,  whether  with  good  inter* 

■ tions  oreva,  is  povrerful  JUw  enforcement  has 
: . done  it repeatedly  in  the  past,  undercutting  jo 
. • sommm  the  assurahces.that  it  won't  happen 
“ AadtheiimaemepwftrS 

; ^v^po^  only  enhao^  t&pr^t 

' / '.TtacVwhy  factions .«'  dtmgeat  as:  ex> 

• *^*^-^®**  &od  .deeply  conservative  mem* 
i . **»of  Congress,  dong  with  the  ACLU  and 
:•  S'®*  P&m  citizens,  fes  nervous  about  the 

; . oeyice.  Its  jeehated  ability  to  run  afoul  of  the 
i Toum- Ammdment’s . protections  against  ms.-* 

\ • reasonable  searches  is  unmistakable. 

/ ‘ .;-Wbat  this  Sap 'points  to-above  all  else  is 
. that  communication  technology  has  far  out- 
paced  die  nation's  wiretap  laws,  some  of  which 

toi  **£  ear5y  ^ ***&*?<■  This  is  a 
ptoptem  cmly  Congress  can  address.  To  its 
credit  and  that  of  the  administration,  some  at* 
tempts  are  in  progress.  ■ 

The  adauaistration  has  asked  that  federal 
laws  oa  internet  communications  security  be 
upgraded  to  assure  that  they  match  the  kind  of 
judicial  and  administrative  restraint  that  al« 
t*8^  ^PR?P  }°  phoae  taps.  Sen.'  Patrick 
leahy,  D-Vt,  has  writtett  a bread-based  In*  > 
J*0^  pnvacgr  big,  and  Sea.  Onin  Han*.  R- 
XJtah,  has  introduced  another,  somewhat  nay- 

Sudr  attempts,  while  laudable,  will  nor  be 
**c«ia»d  for  months,  perhaps  years.  Meaa- 
wd*3e,  the  FBI  has  offered  to  let  an  indepen-  * 

WiI®0me*but  Carnivore  ought  to  be  shutderam 
. JJJj*  «»tha^  ywnpletcd  and 

^ entirely  deprived  of  surveilkjwf^moues, 
out  putfmg  Carnivore  ou  hold  wouldn't  do 
mat.  It  wwtid,  on  the  other  hand,  provide  at 
feast  some  assurance  to  innocent  parties  that 

Pn,?te,  ^ves  area*t  op«t  books.  That 
could  hardly  be  a bad  thing. 

jraTflL  P.02- 

& OC 


™%y  or  most  instances  these  rest  on  a judge- 
si^d  sunmillance  order  keyed  to  evidence  that 
a ^ious  crime  is  being  or  has  been  committed. 

|These  are  welcome  assurances.  But  for  the 
moment,  that’s  all  they  are.  As  one  conservative 
ABbama  congressman  said  at  a Monday  sub- 
c^mittee faring,  *What  you’re 

* , * 0s.r,.,  * 

tht  mb  of  fbe  probten  The  ouu- 
nonsly,  named  Carnivore  is  so  encompassing,  w 
sophisticated,  so  tweakable  — and  its  rmtet- 
workms  so  closely  guarded  that' it’s  almost, 

impossible  for  anyone  besides  its  .operators  to 
know  what  it’s  ready  examining  and  realty  ig-. 

This  dilfcirs  markedly  from  tetajhboe  wire-'- 


.*•  W,«.VUUtW4«WIJ 

■ junction  box  and  attached  connectors 

to  terminals  for  that  phone  and  that  phone 
only.  In  some  instances,  only  brooming  and 
outgoing  phone  numbers  are  registered  In  oth- 
ers; depending  oa  what  a judge  thinks  is  aeees- 
sa^y,  actual  conversations  are  recorded. 

' *.lQ  a sens t,  comparable  service  can  sti2  be 
wtycied  to  law  enforcement  agencies  by  a cus- 
wnter  s Internet  service  provider.  It  is  reasona- 
1^'aKteed  that  only  one  diem’s  communica- 


Carowore  ts  difftreot.  If  da  service  pro* 
.wdtf  atfows  tt  to  be  installed,  the  Carnivore V 
placed  drreedy  ia  the  path  of  the  com* 
.party  s «itire  Internet  data  flow.  The  filter  is 
shgpored  m uaailf”  only  what  it  ts  sd  to  — for 
asoMang  aikJ  outgoing  c-nisui  wi* 
^^es  for  just  one  account  Or  it  out  probe 
more  tto^r.But  everything  moves  through  it 

>dumf  itnik  a ,ut^vr.n  , deals  to  reimies 


n^st  comforting  o^muoa  we’ve 
so  far  came  fh«n  the  FBl’s  Marcus 
'Tftqmas,  a developer  of  the  system.  Me  told  B» 
•Wall  Street  Journal  that  if  Carnivore  actually 
to  read  everything  that  came  through, 
it  .would  bog  Introict  tramc  down,  to  ^ d^grtc 


ll.""  !>  !W  *'  H iiPMi  in  mmh^ 
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7 i ?;  The  number  of  $e*ith  warrants 

- v seeteig  ri&ensf  online  data  has 
soared  more  than  m&  dunngthe 
past  few  years,  a ll^TQMf  mb 

The  findings,  based  on  an  ecamf* 
naoon  of  wanar^s  served  on  the 
K®  Net  service  pnwfoer,  America 
Onaw,  surprised  federal  lawmak- 
er and  dvi!  libertarians  and 
• prompted  calls  lor  legal  reforms, 
j Searches  for  the  Brine  data  typi- 
callymvolvecases  ms^fiwm  ha* 
rsssment  and  child  ponwgr^tyto 
Vtoiea  Clime  and  ted  and  are 
teed  at  discovering  the  identity 

andtradcfogtireaandtiesofsub- 
i scrfcere.  last  year,  AOLwas  served 
*3®  3w search  warrants,  up  from 

33  tn  1937.  This  year,  stare  and  local 
investigators  haw  served  191  war* 
rants  trawtghjuly  17,  filings  show 


AOt  had  r®  comment 

wb  mat!  providers  fo  the  USA 
*«w  experienced  a sfenfoeata:  in- 
aease  fe  the  number  of  search 
giants  and  subpoenas*  said  An-1 
drew  Cresset  an  attorney  who  sp$* 
dates  in  comparer  Saw  - ■ 

Congretenal  leaders  informed 
of the  Jmdngs  s»d  theywiS  eam- 
ine  legal  standards  anpfied  to  such 
tetn«  investigations.  A a mira- 
nwt  House  Majority  leader  Okie 
Amrey,  R-Texas,  said,  police  need  to 
tell  Congress  when,  why  and  how 
they  perform  electrode  searches. 
The  White  House  already  has 
pledged  to  move  soon  to  protect 
zteamicdstaL 

Qitks  and  privacy  experts  fear 
that  etectromt  survelSap^  of  all 
ty^s,  if  iKTt^ghdy  am&tfet  can 
folate  laws  gainst  mmasonaMe 
police  searches.  The  FBft  Thomas 
Gregory  Motta  says  there  is  linfe 


D t i'M;i  i ii¥^ 


_ acw-Ulff 

reason  far  amceat^^^^- 
Sofehe  says,  the  lafhjS1^: 

*1  stored  records,  such  as  e-raaS, 
as  r treats  other  documents,  such 

as  tetters  and  diaries,  which  can  be 

seized  ten  a home  with  a simple 
ssardh  warrant  Often,  though,  au** 
thonoes  adt  for  more  than  e-mail 
A random  sample  of  14  such 
warrants  in  the  past  18  mottos 
showed  tod  10  ashed  for  all  data 
ate  service  had  on  targeted  sub- 
scribers. They  can  get  a record  of 
what  times  you  dated  m.  where 
you  dated  in  horn,  how  long  you 
were  online,  what  activities  you  ^ 
were  engaged  j&  what  Web  sates  : 
you  visited,  what  chat  sessions  you 
were  in  and  what  you  said  there,” 
said  Marie  Rasch,  a former  federal 
prosecutor  and  vice  president  for 
cyber,  law  at  Global  Integrity  in 
suburban  Washington. 
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lit*,.:  ..-•>'  PROrecnON 
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v* ; -SwpESSjfe-* P-S-  Represent^ve OOT lww, announced  ’ 

- ^Smd^'^r^>&ying  &c  ^gtal  PrfviifrActof^^^ 

wu^appmg  kws  to  enhance  privacy  proiecd^  and  &S; 


gggjg”*«  ^«^^'l*w«6K*SSlo 

SfP  ^ electronic  communications,  in  addition  toke^«^;; 
telephone  wiretap  reports  already  required.  S-;,. 


■ Block  the  use  of  electronic  evidence in  court  if  it  is  obtained  illegally. 

SlS^Jif  g0™ent.^eSS  to  the  identities  of  computer  users 
^ 1S  reasonabIe  evidence  a crime  has  been  committed. 

users 


2d SOme  0ff“  nloa  glar”«  wntradiclions 

ranMto XS5SSZ.  2ESSZS2*  *?? “*■  to 
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UNITED  STATES  DISTRICT  COURT 
CENTRAL  DISTRICT  C t CALIFORNIA  - WESTERN  DIVISION 


IN  THE  MATTER  OF  THE 
APPLICATION  OF  THE  UNITED 
STATES  0“  AMERICA  FOR  AN 
ORDER  AUTHORIZING  THE 
INSTALLATION  OF  A PEN 
REGISTER  AND  TRAP  ’ND  TRACE 
DEVICE . 


Criminal  No.  SS-2TI3M 


) ORDER:  U)  DENYING  MOTION  TO  QUASH 
) ORDER  AUTHORIZING  PEN  REGISTER;  ANY 
) (25  GRANTING  APPLICATION  TO  EXTEND 
J ORDER  AUTHORIZING  PEN  REGISTER 


This  case  raises  the  question  whether  this  court  has  th*  j 
1?  j legal  authority  under  the  pet.  register  statute,  IS  O.S.C.  g 3122,  ex  | 

IS  naq.,  to  issue  an  order  requiring  an  internet  service  provider  (ISP)  I 

IS;  to  install  a device  which  captures  the  time,  date,  source  and  i 

20  destination  addressing  information  of  electronic  mail  (e-mail)  j 

21  messages  sent  to  and  from  an  e-mail  address  maintained  by  a customer 

22  at  the  IS?.  After  consideration,  the  court  finds  that  it  has  the  ! 

23  | legai  authority  under  tna  pen  register  statute  to  issue  such  an  c‘rce-'  ^ 

i " ' t 

^ The  discussion  ot  this  issue  arises  in  the  context  of  an  j 

25  I ongoing  criminal  investigation.  The  court  dose  not  want  to  compromise  j 
2S  the  integrity  of  that  criminal  investigation.  Accordingly,  the 
2?  description  of  the  facts  out  of  which  the  current  dispute  arises  j 

28 1 deliberately  omits  factual  Information  which  could  alert  the  subject  | 
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or  subj  ecte  of  the  invest: igation  to  the  existence  of  arid  the 
techniques  used  in  the  investigation. 

On  December  2,  19*9,  the  government,  through  an  Assistant 
United  States  Attorney,  presented  to  the  court  an  ex  parte  application 
for  the  issuance  of  an  order  in  the  nature  of  a pen  register.  The 
application  contained  information  that  a federal  criminal 
investigatory  agency  was  seeking  to  locate  a federal  fugitive,  that 
agents  0f  the  federal  agency  believed  that  the  fugitive  was 
maintaining  contact  with  a specific  named  close  friend  or  relative 
("the  subject"]  by  means  of  e-mail  transmissions  sent  to  the  subject, 
ana  that  the  subject  maintained  an  Internet  service  account  with  a 
designated  Internet  service  provider  {"ISP")  under  the  subject's  name. 
This  court  issued  an  order  providing  that  the  government  agency  -may 


nscs..^l  d.  p$sn  t’&&3.bz&z  z rs^ 


race  device  co  register  time, 


date,  and  source  and  destination  addressing  informat  lots  of  the 
electronic  mail  messages  sent  to  and  from  the  subject  Internet 
account,  including  information,  regarding  the  true  source  of  the 
messages  without  geographic  limitation." 

The  government  agency  served  the  order  on  the  ISP.  The  ISP 
and  the  government  had  some  initial  discussion  regarding  the  order. 
Eventually,  the  isp  attempted  to  comply  with  the  order  by  providing 
the  agency  with  the  "headers’"  {minus  the  subject  or  regarding  line)  of 
numerous  incoming  messages  to  the  subject's  e-mail  account  and  the 
headers"  of  a few  outgoing  messages  (with  the  subject  or  regarding 
information  deleted)  from  the  subject  account.  The  government  is  not 
satisfied  with  this  response,  contending  that  the  terms  of  the  order 
entitle  it  to  install  its  own  device  on  the  premises  of  the  jgp 
connected  to  ISP's  equipment. 
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1 j>  ae  a result  of  this  dispute,  the  IS?  has  now  moved  to  quash 

2 \ or  modify  the  order.  The  government  has  opposed  the  motion  to  quash 

3 and  separately  submitted  an.  ex  parte  application  requesting  an 
<!  extension  of  the  court's  previous  order. 

5 At  an  initial  scheduling  conference,  the  parties  represented 

6 t that  the  court's  original  Order,  issued  December  2,  1999,  would  expire 
?!;  February  4,  2000 . This  court  scheduled  a hearing  on  the  ISP's  motion 

to  quash  or  modify  the  order  on  February  4,  2000.  It  now  appears  to 

i 

$[  the  court:  that:  the  order  has  already  expired,  the  statute  provides 
10  I chat  tho  court  may  issue  an  order  authorising  the  installation  of  a 
111  oen  register  Mfor  & Deriod  not  to  exceed  SO  days,*  18  W*3.C*  § 

12  I 3123(c)  (1) , The  Order  was  issued  on  December  2t  X Pursuant  to 

13  | the  terras  of  the  statute/  the  order  expired  £0  days  thereafter  on 

14  I w &nua r y 3 1 «.  30  00. 

15  | There  is  no  presently  effective  order  in  plane  which  this 

| court  may  quash.  The  court  therefore  denies  the  ISP's  notion  to  quash 

I 

17 i as  moot, 

I ... 

18  a Although  that  ruling  resolves  the  ponding  motion  of  the  ISP 

18;!  to  quaah,  it  does  not  resolve  the  underlying  issue  whether  the  court 

20  ; has  the  authority  to  issue  an.  order.  That  issue  is  now  presented  to 

21  the  court  because  the  court  must  decide  the  government's  application 

22  I to  extend  the  order . 

23  i The  statute  provides  that; 

24  j “the  court  shall  enter  an  ex  parte  order  authorizing 

as  | the  installation  and  use  of  a pen  register  or  a trap  and 

' : 

26  I trace  device  within  the  jurisdiction  of  the  court  if  the 

27  court  finds  that  the  attorney  for  the  Government  or  the 

26 1 State  law  enforcement  or  investigative  officer  has  certified 

3 
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to  court  that  cho  information  likely  co  be  obtained  by 
sucn  i^staj-lation  and  use  is  relevant  to  an  ongoing  criminal 
invest  ic&tlon . « 

18  XJ.8.C.  § 3123(a)  . 

The  government  has  certified  to  the  court  that  the 
information  likely  to  be  obtained  by  the  pen  register  or  trap  and 
k-racs  device  is  relevant  to  an  ongoing  criminal  investigation.  This 
court  accordingly  has  authority  to  issue  a proper  pen  register  or  tree 
and  trace  order.  The  question  presented  here  is  whether  the  device 
which  the  government  seeks  to  install  is  a device  described  and 
authorized  in  the  statute. 

The  statute  defines  a "pen  register"  as • 

"a  device  which  records  or  decodes  electronic  or  other 
impulses  which  identify  the  numbers  dialed  or  otherwise 
transmitted  on  the  telephone  line  to  which  such  device  is 
attached  . . , 

18  t\S.C,  § 3127(3}. 

The  statute  describes  a "trap  and  trace  device*  agj 
"a  device  which  captures  ths  inccraing  electronic  or  other 
impulses  which  identify  the  originating  number  of  an 
instrument  or  device  from  which  a wire  or  electronic 
communication  was  transmitted, " 

18  U.S.C.  § 3127 ($) , 

It  is  apparent  that  a pen  register,  as  defined  in  the 
statute,  is  intended  to  be  a device  which  captures  the  telephone 
numbers  dialed  by  a target  phone,  h trap  and  trace  device  is  intended 
to  capture  the  telephone  numbers  of  telephones  which  make  calls  to  a 
target  phone.  It  is  also  fairly  clear  that  the  drafters  of  the  pen 
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register  statute  did  not  contemplate  that  the  statute  would  be  used  to 
authorize  the  issuance  of  court  orders  to  capture  the  e-mail  addresses 
of  persons  sending  e-mail  to  and  receiving  e-mail  from  a targeted  e- 

j 

mail  address . 

The  statutory  definition  of  a pen  register  describes  a 
device  attached  to  a telephone  line,  28  U.S.C.  f 3127(3}  . The 
statutory  definition  of  a "trap  and  trace  device"  does  not  limit  the 
description  to  & device  attached  to  a telephone  line.  28  U.S.C.  S 
3127  {4} » "Konsthaless,  it  appears  from  the  construction  cf  related 
sections  of  the  statutes  governing  trap  and  trace  devices  that  they 
include  only  devices  that  ere  attached  to  a telephone  line."  Tn  thia 


devices  must  include  * the  number  and,  if  known,  physical  location  of 


the  telephone  line  to  which  the  pen  register  or  trap  ana  trace  device  j 
is  to  be  attached  . . . ,*  is  U.S.C.  § 3123(b)(1)(C).  j 

It  is  clear  that  the  government  here  does  not  intend  to 
attach  either  a conventional  pen  register  or  a trap  and  trace  device 
to  the  subject's  telephone  line.  The  government's  opposition  to  the 
ISP’s  motion  to  quash  contains  & description  by  a technician  declarant 
of  how  the  government  intends  to  implement  the  requested  order.  The 
government  would  install  a computer  program  called  "Carnivore*  on  the 
ISP's  network,  probably  on  a "router"  used  by  the  IS?.  A "router1'  is 
described  as  a transmission  device  that  processes  paeketized  network 
information . Both  the  router  and  the  is?'  s network  are  connected  to 
the  telephone  lines  and  transmit  paeketized  network  information  over 
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if  telephone  lines.  Th&  Carnivore  software  program  would  look  for  the 

2 ! target's  loo -in  name  (presumably  for  outgoing  e-mail ! or  the  target's 

3 ] electronic  nys.il  name  (presumably  for  incoming  e-mail}  . The  program 

4!  would  then  capture  the  "header*  information  associated  with  the  e-mail 
sj  message,  including  the  time,  date,  and  addressing  information, 

S,j  including  Internet  identity,  for  messages  sent  to  or  from  the  target 
7 I account.  The  pregram  would  not  capture  the  subject  or  regarding  line 
8;!  of  the  e-mail  message  or  the  content  of  the  message.  The  captured 
s ] material  would  be  stored  on  a government  computer  which  presumably 
10 i would  be  attached  to  the  IS?' s router. 

11 f A conventional  pen  register  is  attached  to  telephone  lines 

12  f and  captures  the  telephone  number  dialed  by  the  target  telephone,  A 

13  | trap  and  trace  device  is  attached  to  telephone  lines  and  captures!  the 

14  j telephone  numbers  calling  the  subject  telephone.  Here,  the 

15 1 government's  reguested  device  is  a computer  and  software  program 

[t 

16 ! attached  to  the  ISP's  equipment  which  is,  in  turn*  connect ed  to 

! 

I?  telephone  lines  and  which  captures  the  Internet  e-mail  addressee  of 
is  | persons  sending  to  or  receiving  e-mail  from  the  target.  There  appears 

15  1 to  be  no  significant  difference  between  capturing  telephone  numbers 

20  with  a pen  register  or  trap  and  trace  device  and  capturing  e-mail 

21  addresses  with  the  government's  proposed  computer  and  software 


22 1 program, 


This  court  acknowledges  that  the  pen  register  statute,  18 


24  | v.S.C.  § 3122 » m is  contained  in  Title  III  of  the  Federal 

25  j Electronic  Communications  Privacy  Act  of  1986 1 that  one  of  the  evident 

26  | purposes  of  that  statute  is  to  regulate  government  intrusion  into 
27 1 private  communications,  and  that  the  statute  should  be  strictly 


ZB  1 construed,  Ic-Xibl 
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court  finds  that  the  intrusion  into  otherwise  private  activity  which 
would  be  allowed  by  the  issuance  of  the  government's  requested  order 
is  no  greater  than  the  intrusion  created  by  the  issuance  of  a 
conventional  pen  register  order-  Although  apparently  not  contemplated 
by  the  drafters  of  the  original  statute*  the  use  of  a pen  register 
order  in  the  present  situation  is  compatible  with  the  tents  of  eke 
statute*  Accordingly,  the  court  will  grant  the  government's 
application  for  the  continued  use  of  a pen  register  and  issue  an 


appropriate  ordes 


oriel ns 


;he  reasons  seated  above , the  ISP's  motion  to  quash  the 
authorising  the  installation  of  a sen  register  is 


denied  as  moot.  The  government*  s application  for  the  continued  use  of 
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DECIARATION 

I Edward  Kill  hereby  declare  as  follows : 

1,  1 art;  a Special  Agent  with  Che  Federal  Bureau  of 
Investigation,  and  have  been  an'  Agent  for  ID  years.  1 specialize 
in  technical  equipment,  including  electronic  surveillance 
equipment . I am  familiar  with  the  Internet  and  with  surveillance 

devices  used  for  the  internet. 

2,  if  authorised  by  this  court,  i or  other  technicians 
intend  to  install  a program  called  Carnivore  to  obtain  the 
information  sought  in  this  order.  The  program  will  be  installed 
©n  Karthl/ink’s  network,  most  likely  on  a "router B used  by 
Earthi-ink . A "router”  is  a transmission  device  that  processes 
packet ised  network  information,  Both  the  router  and  EarthLink1 e 
network  are  connected  to  the  telephone  lines  end  transmit 
packet ised  network  information  over  the  telephone  lines.  Ch© 
Carnivore  software  program  watches  the  incoming  telephone  traffic 
to  EarthLink  and  looks  for  the  targeted  subscriber's  log-an  name 

i 0r  electronic  mail  account  name.  If  it  finds  the  target's  log-in 
I n&me,  the  program  follows  the  target  while  the  target  as  on  line. 
The  program  then  captures  only  tha  header  information  for 
electronic  mail  messages  sent  or  received  fey  the  target  while  the 
target  is  on  line.  If  the  program  finds  the  target's  electronic 
! nail  account  name,  it  will  capture  the  header  information 
associated  with  that  electronic  mil  message.  Specif ieally,  tha 
1 program  will  capture  the  time*  &Ets>  and  tha  Redressing 
inf ormation  Internet  identity)  f&r  electronic  m&xl 

| messages  sent  to  or  from,  the  account < The  program  will  not 


5/24/02  Release  - Page  6 


capture  the  subject  or  regarding  line  on  the  electronic  mail 
message/  nor  dose  it  capture  the  content  of  the  message  or  any 
information  concerning  the  target's  other  ©n  line  activity. 

3.  Although  the  program  is  capable  of  capturing  more  than 
the  information  authorized  under  the  order,  I or  the  installing 
technicians  will  configure  the  program  in  a manner  that  will 
prevent  the  program  from  capturing  any  information  that  is  not 
authorized  under  the  order.  In  addition,  the  computer  used  to 
run  the  program  has  limited  memory  capacity  and  limited  ability 


ID  I to  process  information.  Because  of  these  limitations  the 


computer  used  to  run  the  program  would  be  overloaded  within  a few 
minutes  if  it  attempted  to  collect  all  of  the  information,  on 
Earthlink's  8 to  1C  million  e-mail  messages.  Moreover,  the 
program  will  be  installed  on  a particular  entry  point  into 
Earthlink's  network,  and  as  such  would  not  have  access  to  all  cf 
Earthlink 1 e customers. 

4.  the  program,  should  not  create  a security  risk  for 
Earthlink.  Although  the  Carnivore  program  is  remotely 


19:1  accessible,  it  has  several  security  provisions  that  prevent  an 

20 • intruder  from  obtaining  unauthorised  access  to  Earthlink' s 

21 { system,  svsn  if  an  intruder  did  obtain  such  access,  the  program 

22  lacks  a TCP/IP  protocol  stack,  which  means  that  the  intruder 

23  i would  be  unable  to  communicate  With  Earthlink's  eye  tern  from  the 

24  government's  computer.  I and  other  agents  with  whom  1 work  have 

25  Installed  this  program  at  many  other  service  providers  (including 

26  AT&T}  and  have  not  had  security  problems  or  objections  from  the 

27  : providers. 

28  25 
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isX-!Denver ' | ( ..... 


From:  \ WKKKtttm'  ' ^ 

to;  iDwOTTspiKe 

Oats:  ; . ~ 4/5/00  S:2SPM  ■ ~ . ;.  ' \ '■  X 

Subject:  •' 

j just  receded  a call  fronflMIBs  OIPR:  Tq  state  tftat  Shifts  unhappy.  wfthlTOS  and  the 
UBLUnitwsufelbean  un^Sa^MMinSw^ ftfopoftpcwis,  • j'wiltiy Jo  relate  thinks  has 

happened  with,  the  above  earned  FISA.  • • • . '■  . . 


MMlsecured  an  Et-SUR  FlSAjvery  quickly'  6Wmm  the  request  of  _ 
thatsne  was  assured’  that  the  FBI  had  special  softwarelwHibh  cpulddo  w 
fectJBBBstates  that  the  technical  people  In  Quantico- approved  the  FISA  language. 


ra'Tiiir-ssfclEElFfH 


coulcTdo.  In 


The  FBI  technical  people  went  to  install  the  FBI  software ; 
electronic  surveiiisnce  on  March  1$; 


accomplish  the 


The  software  was  turned  ©hand  did  not  work  correciiy^The  FBf  software  not  only  picked  up  the  E-Mails 
under  the  electronic  surveillance  of  the  FBI’®  targei,*|PJ^  bid  disc  picked  up  E-Mails  on  non-covered 
targets.  The  FBI  technical  person  was  apparently  soTTpsst'that  ha  di$troye^inh^-M^l  take,  including 
the' take  oni®^||ijHBJiC'U.ndef  the  impression  . that  ho  one  from  the  FS^HHJBwas  present  to 
supervise  theFSHecrpcal  person  at  the  time.  Now  the  FBI  tec^ie^fj^ojMew««WT8lnt  new  software 
experiment  at  the  carrier  to  see  if  it  works. " - • ■ ■ • ' • ; .■  ' ' • 

MHktates  that 'OIPR  was  . never  told  thst  the  FBI  software  was  experimental  OIPR  was  informed  that  it 
woodwork.  - The  FBI  technical  people  are  still  trying  to  make  it  Work  IngHMV,  and  want  to  resume  the 
electronic  surveillance.  The  FBI  people  in  pttM^also  want  a physical  search  warrant  to  pick  up  the 
E-Mails  from  the  carrier,  which  the  FBI  picked  upon  the  target,  but  destroyed. 

Hft  informed  me  that  the  FBI  does  not  have  the  auihohty  to  resume  electronic  surveillance  until  she 
receives  a written  explanation  of  what  has  happened  and  s'heSiss  something  with  the  court.  Obviously, 
she  has  no  intention  of  securing  a search  warrant  either  unfel. this  is  straightened  out. 

When  you  arid  this  story  to  the  'prepared  to  go  to  the  field,  and 

which  is  in  NSLU  for  signature  before  it goeis  *4NNHMP®^  hfi>  Signature,  you  have  a pattern  of 
occurfehces  which  Indicate  to  OIPR  an  inability  ori-the  pert  of  the  FBI  to  menage  its  FISAs. 

HMHH'andHHHbleese  see  me  ASAP. 


/ Xf$ 
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DITU  Legal  issues 


Date: 

Subject: 


Tue,  Apr  11,2000  9:00  AM 
DITU  Legal  Issues 


The  attached  sets  out  a few  Issues  we  would  like  to  discuss  with  you  so  that  we  can  work  toward 
providing  a reasonalbe  and  practical  guideline  to  personnel  in  our  Unit  and  the  Field. 


My  number  is  703| 


I will  bo  on  leave  from  Thursday  through  next  Tuesday. 


£>7  C-l 
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The  following  sets  out  some  of  the  legal  issues  facing  DITU 
as  well  as  some  thoughts  on  ways  to  proceed.  We  need  your  legal 
guidance  in  this  matter  to  formulate  a reasonable  and  prudent 
course  of  action,  as  well  as  a practical  working  guide  for  the 
personnel  of  DITU  and  the  Field  Office  personnel  involved  in  Data 
Intercepts*  I am  sure  there  are  other  issues  and  ideas,  but  this 
may  be  a good  start.  Call  me  to  discuss  this  in  more  detail.  I 
am  willing  to  travel  to  your  office  at  FBIKQ  or  to  meet  with  you 
here  at  QT , If  you  need  any  clarification  of  technical  concepts 
etc,  you  may  call  703  -VMHMNBor  SSA 


at 


'UJ 


To  initiate  an  intercept  on  a network  or  at  an  ISP,  the  DITU 
installs  a collection  device  with  appropriate  filters  set  to 
capture  data  within  the  scope  of  the  Court  Order  or  the  effective 
consent  of  a consenting  party.  This  filtering  process,  a 
component  of  Ether peek  and  Carnivore,  filters  based  on  TCP/IP 
standards.  On  occasion  we  encounter  non-standard  implementation 
of  transmission  control  and  Internet  protocols  within  a network 
or  at  an  ISP.  Encountering  non-standard  implementation  has  led 
to  inadvertently  capturing  and  processing  data  outside  the  Order 
or  Consent . 

Issue  I 

In  instances  where  we  encounter  non-standard  implementation 
of  a protocol  which  leads  to  the  improper  capture  of  data,  two 
main  concerns  arise.  The  first,  and  of  most  immediate  concern, 

Is  the  formulation  of  a guideline  to  be  followed  in  resolving  the 
matter*  This  guideline  should  extend  from  the  DITU  personnel  who 
installed  and  likely  discovered  the  error,  through  DITU 
Management  representatives.  Field  Division  Case  Agents,  CDCs, 
notifications  to  AUSAs , Motions  to  Seal*  etc. 

Issue  II 


The  second  issue,  critical  in  efforts  to  intercept  the  data 
under  the  Court's  Order  or  under  consent  from  a test  account,  is 
how  FBI  technical  personnel,  such  as,  Engineers,  Computer 
Programmers  and  others,  may  lawful  examine  the  collected  data  foi 
the  sole  purpose  of  determining  why  the  filters  failed  and  what 
software  changes  need  to  be  made  to  bring  the  collection  in  line 
with  the  scope  of  the  existing  Order.  We  need  to  look  at  the 
data  to  figure  out  what  is  wrong  and  how  to  fix  it  Hi 
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Issue  III 

A third  issue  which  we  would  like  you  to  consider  is  that  we 
frequently  set  up  user  accounts  on  networks  and  install  data 
intercept  devices  to  perform  a "test  tap"  under  our  own  consent. 
This  is  generally  done  as  a means  of  verifying  that  the  location 
on  the  network  and  the  filter  set  would  be  appropriate  for  an 
anticipated  or  existing  intercept  Order.  In  the  event  that  we 
are  doing  a "test  tap"  under  consent,  looking  for  our  own  mail, 
etc,  and  inadvertently  capture  something  outside  our  consent, 
such  as  another  persons  mail,  what  are  our  options?  Is  it  a 
violation  of  Till  if  the  interception  is  not  intentional  and  we 
do  not  disclose  or  endeavor  to  disclose  the  information  to 
anyone?  May  we  destroy  the  information  and  simply  not  disclose 
it  to  anyone? 


Issue  IV 

Random  Access  Memory  RAM 


In  relation  to  the  "testing"  of  network  placement  and 
filters,  it  is  generally  a technical  requirement  to  install  the 
device  with  appropriate  filters  set  and  initiate  the  capture 
process.  It  may  be  hours  or  days  before  a determination  can  be 
made  as  to  the  functional  operation  of  the  collection.  During 
these  first  few  hours  or  days,  the  technical  representatives  of 
the  FBI,  Electrical  Engineers,  Electronics  Engineers,  Technically 
Trained  Special  Agents  and  others  may  frequently  examine 
collected  data  to  determine  the  efficacy  of  the  installation.  In 
relation  to  the  time  period  from  installation  to  the  verification 
of  proper  function,  the  following  question  is  posed  for  your 
consideration.  Is  there  a significant  legal  difference  between 
Random  Access  Memory  (RAM) , that  which  is  not  retained  when  power 
is  removed,  and  of  a hard-drive  or  floppy  disk  which  retains  the 
data.  The  thought  process  here  in  the  DXTU  being  that;  during 
the  period  of  time  from  the  installation  to  the  verification  of 
proper  function, • the  data  could  be  directed  to  remain  in  RAM  and 
not  be  forwarded  to  a permanent  media.  Technical  representatives 
could  then  examine  the  collected  data  for  proper  filtering  and 
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assure  that  the  collection  is  operating  within  the  scope  of  the 
Order. 

If  the  collection  appears  technically  correct,  it  could  then 
be  re-directed  from  RAM  to  permanent  media  and  the  intercept 
initiated.  If  not,  the  data  could  be  examined  in  RAM  by  Computer 
Programmers/Engineers  to  determine  a filtering  change  or  software 
patch  necessary  to  effect  the  Court  Ordered  intercept.  The  data 
in  RAM  would  not  be  retained  by  the  computer  on  power-off. 

By  directing  collected  data  to  remain  only  in  RAM,  we  may 
gain  both  the  ability  to  troubleshoot  installations  and  to  assure 
that  the  data  is  not  written  to  "storage  media"  nor  recoverable 
from  any  media. 
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ISP  INTERCEPTS f MAIL 


From: 

To: 

Date: 

S object: 


THOMAS,  MARCUS  C 


t 2000  5:53  PM 


ISP  INTERCEPTS  E-MAIL 


See  the  attached.  After  you  all  get  a chance  to  review  my  initial  thoughts  regarding  your  questions/issues, 
lets  then  plan  to  sit  down  and  talk. 


„ i-ftse-rw5" 

sW»wl*** 

7>oC.  >*7 


4/12/2000 


TO:  Marcus  Thomas 


FROMHB 

RE:  Intemet/E'Mail  Intercepts 

This  is  in  response  of  4/3  3 regarding  the  captioned  matter.  I 

The  following  are  some  preliminary  reactions  and  thoughts.  They  are  not  necessarily  final  legal 
answers  or  guidance.  They  are  offered  to  stimu  late  further  consideration  on  all  of  our  parts.  As 
was  suggested  in  the  E-mail,  we  all  need  to  sit  down  in  the  very  near  future  and  take  a little  time 
to  talk  about  our  intercept  approaches,  as  well  as  what  we  must  do  when  they  unintentionally  go 
astray. 

Background: 

We  need  to  start  with  a few  high-level  and  familiar  thoughts,  because  they  form  a background  and 
context  for  the  subsequent  discussion.  As  we  are  all  aware  and  appreciate,  electronic  surveillance 
is  a very  sensitive  investigative  (and  intelljgence/counterintelligence}  technique,’  As  such,  for 
over  30  years,  it  has  been  carefully  regulated  by  and  tluough  statutory  regimes  at  both  the  Federal 
and  State  levels  — which  regimes,  in  many  instances,  contain  provisions  that  arc  very  specific,  and 
which  contain  dictates  that  are  quite  detailed  in  their  procedural/administrative  aspects.  On  its 
face,  the  language  of  these  regimes,  as  written  by  the  Congress,  is  essentially  black  and  white,  and 
generally  is  unforgiving:  one  complies  with  the  statutes  or,  alternatively,  violates  them.  In 
enacting  these  regimes.  Congress  sought  to  balance  and  advance  privacy  and  effective  law 
enforcement.  Moreover,  given  the  sensitivity  of  this  technique,  electronic  surveillance  has  been 
the  subject  of  on-going  scrutiny  by  Congressional  oversight  committees,  the  press,  privacy 
groups,  and  the  public.  In  short,  there  are  few,  if  any,  investigative  techniques  that  are  (and  have 
been)  subjected  to  such  heightened  scrutiny.  And  there  are  few,  if  any,  investigative  techniques 
that  gamer  (and  have  garnered  in  the  past)  such  vehement  criticism  when  errant  surveillances  or 
missteps  (be  they  intentional  or  unintentional)  occur. 

While,  as  noted  above,  the  electronic  surveillance  laws  are  often  specific  and  detailed  in  their 
provisions,  general  ly  they  do  not  address  the  precise  aspects  of  how,  technical  speaking,  the 
“intercept”  is  to  occur.  Congress  eschewed  doing  so  because  it  would  be  a bad  idea  to  tty  to 
delineate  all  the  various  potential  interception  methodologies/approaches.  To  do  so  would 
infringe  upon  Executive  Branch  prerogatives  in  “executing”  the  laws.  And,  it  would  get  into 
sensitive  intercept  sources  and  methods,  etc.  Nevertheless,  both  the  Congress  and  the  courts  have 

1 While  we  in  our  particular  area  of  law  enforcement  are  so  close  to  thi  s matter  that  we 
literally  live  and  breathe  electronic  surveillance,  to  others  (especially  those  outside  of  law 
enforcement),  any  electronic  surveillance  is  a big  thing! 
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an  extremely  keen  interest  in  making  sure  that  several  things  are  being  attended  to  by  the 
Executive  Branch  in  conducting  electronic  surveillance  searches  and  seizures:  (1)  that  illegal, 
unconstitutional  searches  are  not  occurring  (i.e.,  that  no  searches  of  persons*  communications  are 
occurring  without  probable  cause/warrant/emergency);  and  (2)  that  the  spirit/intent/letter  of  the 
electronic  surveillance  laws  (as  implemented  of  constitutional  law  - at  least  to  a degree)  are 
being  carried  out  carefully  and  judiciously.  One  aspect  of  this  involves  the  requirement  that  such 
surveillances  only  be  approved  with  high-level  departmental  approval  and  with  on-going 
Departmental  legal/administrative  oversight. 

Interceptions  of  the  “Older”  Communications  Technology 

It  is  probably  fair  to  say  that,  historically.  Congress  has  been  of  the  opinion  (and  correctly  so) 
that,  for  Jaw  enforcement,  effecting  a lawful  interception  was  not  a particularly  problematic 
endeavor.  Typical  wire  line  sen-ice  lent  itself  to  reasonably  easy  segregat  ion  of  a target’s 
communications  to  the  target  line,2  and  thus  to  concomitantly  effecting  lawful  (and  effective 
technically-targeted)  interceptions.  With  other  identifiers  (ESNs,  MINs,  Cap  Codes,  etc,)  being 
available,  accurately  targeted  interceptions  of  cellular  phones  and  pagers  could  likewise  be 
effected  by  law  enforcement.  Importantly,  Congress  understood  that,  in  order  to  effect  accurate 
interceptions,  law  enforcement  would  seek  and  obtain  assistance  from  electronic  communication 
service  providers  (BCSPs)  and/or  others  to  properly  conduct  the  intercept  (“...upon  request  [of  an 
ECSP,  it  shall]  furnish  the  applicant  forthwith  all  information,  facilities,  and  technical  assistance 
necessary'  to  accomplish  the  interception  ...  with  a minimum  of  interference  with  the  sendees  [the 
ECSP  is  according  to]  the  person  whose  communications  are  to  be  intercepted”).  251 8 U.S.C. 
2518(4).  Until  1994  (see  below),  there  is  no  clear  indication,  in  the  statutes  or  otherwise,  that 
Congress  ever  understood  interception  accuracy  to  be  an  issue  for  law  enforcement. 

Where  potential  “over-acquisitions”  could  arise.  Congress,  privacy  groups,  and  others  have 
homed  in  and  taken  an  interest.  For  example,  with  regard  to  pen  register/DNRs,  Congress  and 
others  have  been  concerned  about  certain  (but  not  all)  post  cut-through  dialing  - i.e.,  certain 
dialing  that  arguably  constitutes  a substantive  communication  - even  though  related  to  the  target 
individual  (as  opposed  to  communications  of  others).  In  this  regard,  Congress,  as  part  of  the 
CALEA  legislation,  specified  in  18  U.S.C.  3121(c)  that  law  enforcement  “shall  use  technology 
reasonably  available  to  it  that  restricts  the  recording  or  decoding  of  electronic  or  o ther  impulses  to 
the  dialing  or  signaling  information  utilized  in  call  processing.”  Similarly,  under  CALEA’ s 
assistance  capability  requirements.  Congress  specified,  as  a statutory  requirement  as  part  of  the 
interceptionpapabiljty,  that  telecommunications  carriers  meet  their  obligation  “in  a manner  that 


? One  possible  exception  being  “party-line”  service,  which  by  now  is  pretty  rare.  Its 
unclear  exactly  what  Congress  would  think  about  such  party-line-related  intercepts.  Presumably, 
minimization  could  be  employed  to  parse  the  target  subscriber’s  calls.  But,  at  the  end  of  day, 
under  the  statu  tory  regime/language,  the  telephonic  communications  being  targeted  for 
interception  would,  in  fact,  be  occurring  over  the  properly-targeted  telephone  line/facilitv.  Here, 
law  enforcement  would,  at  least,  be  on  the  correct  line/facility  that  had  been  authorized  for 
interception  by  the  court. 

2 
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protects ...  the  privacy  and  security  of  communications  and  call-identifying  information  not 
authorized  to  be  intercepted.../’  47  U.S.C.  1002(a)(4)(A). 

Internet  and  E-mail  Sendee  Providers 


Both  Internet  Service  Providers  (ISPs)  and  E-mail  service  providers  are  comprehended  within  the 
term  “providers  of  ‘electronic  communication  service”'  under  the  ECPA  and  Title  III/FISA.  See, 
e.g.,  1 8 U.S.C.  2510(15).  Moreover,  certain  facets  of  E-mail/ISP  service,  at  least  with  regard  to 
the  acts  of  transmitting  and  routing  wire/electronic  communications,  can  also  constitute  activity  of 
a telecommunications  earner,’  thereby  subjecting  the  communications/carrier  to  the  provisions 
ofCALEA,  See  47  U.S.C.  1001(B).  Accordingly,  certainly  under  the  ECP A/Title  III/FISA  (and 
perhaps  under  CALEA),  such  electronic  communication  sendee  providers  are  mandated  to  afford 
all  the  necessary  assistance  to  properly  effectuate  an  interception  of  electronic  communications. 
Consequently,  whenever  there  is  an  electronic  surveillance  order,  and  whenever  there  are  any 
questions  about  “standard/non-standard  transmission  controi(s),”  “protocols,”  or  any  other 
technical  Information  matter  of  consequence  in  properly  and  accurately  effecting  electronic 
surveillance,  these  sendee  providers  are  duty-bound  to  work  with  us  in  properly  and  lawfully 
effecting  the  surveillance  order. 


Internet/E-mail  Interceptions 

In  the  referenced  DITU  E-mail,  it  is  explained  that  certain  Etherpeek  and  Carnivore  "filters”  are 
utilized  to  (hopefully)  capture  data  (and  only  that  data)  authorized  for  interception  in  an  electronic 
surveillance  order  or  pursuant  to  consent.  The  E-mail  mentions  that,  on  occasion,  when  non- 
standard implementations  have  been  encountered,  data  outside  the  court  order  or  consent  have 
been  captured  and  processed  inadvertently.  DITU  then  presents  several  issues  for  examination.  In 
the  tust  two,  DITU  (1)  seeks  guidance  as  to  formulating  guidelines  for  reacting  to  such 
Inadvertent  interceptions  and  (2  ) whether  additional  examination  of  such  non-authorized  data  is 
permitted  to  remedy  the  errant  collecnoaTIitering  efforts. 

As  noted  in  the  background  comments,  the  electronic  surveillance  statutes  speak  at  a rather  high 
level,  and  are  essentially  black  and  white  in  nature  — with  one  either  complying  with  the  law  or 
facially  violating  it.  The  Title  III  statutes,  generally  speaking,  are  not  “specific  intent”  statutes. 
That  is,  one  does  not  need  to  have  special  or  particular  bad  intention  o r motive  to  facially  violate 
the  law.  Further,  since  the  protection  of  personal  communications  privacy  is  a key  facet  of  the 
statutory  purpose  and  regime,  any  unauthorized  in  terception  of  another’s  communications  is  a 
matter  of  concern  (at  a minimum).  Indeed,  some  might  argue  that  the  government’s  unauthorized 
interception  of  such  communications  is  even  more  problematic. 

Historically,  as  a matter  of  Departmental  practiee/policy,  unauthorized  interceptions  (be  they  of 
the  subject  of  the  interception  or  others)  have  been  taken  seriously  by  DOJ  (and  by  the  FBI  for 
that  matter).  When  detected,  DOJ  has  advised  AUSAs  to  (1)  file  a pleading  with  the  court 
explaining  the  unintentional/intentional  act  and  to  (2)  seal  the  unauthorized  intercepted 
communications  with  the  court,  in  order  to  prevent  further  harm  such  as  subsequent  use  or 

(see  IB  U.S.C.  251  l(l)(c)(d),  2515).  Such  unauthorized  interceptions  not  only  can 
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violate  a citizen’s  privacy  but  also  can  seriously  “contaminate"  ongoing  investigations.  In 
addition,  DOJ  could  also  counsel  the  AUSA  to  recommend/not  recommend  to  the  court  whether 
or  not  the  person(s)  who  communications  were  improperly  intercepted  should  be  notified. 

Interestingly,  under  Section  251  l(2}(a)(ii),  while  Title  HI  specifies  that  “no  [criminal]  cause  of 
action  shall  lie  in  any  court  against  any  provider  of  wire  or  electronic  comm  unication  service,  its 
officers,  employees,  or  agents,  landlord,  custodian,  or  other  specified  person  for  providing 
information,  facilities,  or  assistance  in  accordance  with  the  terms  of  a court  order  or  certification 
[under  Title  III],"  there  is  no  similar  explicit  protection  for  law  enforcement  personnel  under  this 
provision.  Now,  practically  speaking,  there  is  virtually  no  chance  that  law  enforcement  officers 
acting  in  good  faith,  pursuant  to  a court  order,  are  going  to  be  criminally  prosecuted  (or  even 
investigated)!  As  to  civil  liability,  under  1 8 U.S.C.  2520(d),  Title  HI  states  that  “a  good  faith 
reliance  on . ..  a court  warrant  or  order,  a grand  Jury  subpoena,  a legislative  authorization,  or  a 
statutory'  authorization...  is  a complete  defense  against  any  civil  or  criminal  action  brought  under 
[Title  HI]  or  any  other  law."  So,  here  too,  law  enforcement  personnel  should  be  immune, 
practically  speaking,  from  any  liability.  (Further,  even  if  (in  a semi-egregious  case)  liability  were 
to  be  found,  it  would  almost  certainly  fall  to  the  agency  — not  the  agent/support  personnel.) 
However,  the  FBI  itself  routinely  does  conduct  OPR-type  inquiries,  from  an  administrati  ve 
perspective,  in  order  to  determine  the  nature/cause,  etc,  of  any  investigative  missteps  or  errors 
which  facially  violate  a law,  with  an  eye  toward  preventing  future  reoccurrences,  etc. 

In  a similar  fashion,  missteps  under  FISA  lead  to  mandatory  reporting  to  the  President’s  Foreign 
Intelligence  Advisory  Board  (PFIAB),  and  such  errancies  must  be  reported/explained/justified  to 
Congress. 

Issue  #1: 

In  short,  then,  as  to  the  first  issue,  upon  detecting  an  inadvertent,  unauthorized  (unlawful) 
interception; 

A)  the  technical  effort  that  is  causing  the  mistake  should  be  stopped  immediately  (and  not  re- 
instituted  until  advised  to  do  so  by  the  supervising  attorneys); 

B)  the  error  should  be  reported  immediately  to  the  FBI  substantive  ease  personnel  in  the 
field/headquarters  (as  appropriate),  to  the  field  office  TA  and  CDC,  and  to  the  respective 
AUSA/OIPR  supervisory  attorney  (who,  in  turn,  will  presumably  advise  the  court); 

C)  the  reporting  as  to  the  errant  interception  should  be  careful  and  clear  so  that  those  to  whom  it 
is  reported  will  folly  understand  what  happened;  the  reporting  should  not  include  any 

substantive  aspect  of  the  content  of  the  communication  that  may  have  been  gleaned;  and 

D)  the  unauthorized  intercepted  material  should  be  segregated  immediately  as  a prelude  to  formal 
sealing  with  the  court. 

Issue  #2: 


As  to  “examining"  the  unauthorized  intercepted  data  (albeit  for  the  sole  purpose  of  determining 
why  the  filters  failed  and  what  changes  need  to  be  made),  this  is  a very  delicate  and  potentially 
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problematic  area.  It  would  appear  that  continuing  to  look  at  (examine  and  “use”)  the  substantive 
content/plain  text  of  the  material  that  was  not  authorized  for  interception  would  most  aggravate 
Title  Ill’s  concerns/ dictates  (see  Sections  251 1 and  2515),  and  most  likely  would  heighten  the 
legal  problem  in  the  minds  of  the  Department,  FBI-OPR,  the  court,  Congress,  privacy  groups,  the 
public,  etc.  I f,  on  the  other  hand,  there  is  some  way  of  looking  at  the  signaling,  programing, 
protocols,  etc.  hi  a raw/uninteliigihle state  (lean  amplify  later),  this  might  be  okay  if  (1)  it  is  for 
the  sole  purpose  of  determining  why  the  filters  failed  and  what  changes  need  to  be  made,  and  i f 
(2)  it  is  approved  by  the  AUSA/OIPR  (and/or  the  court  if  the  AUSA/GIPR  believe  warranted  - 
such  court  permission  in  this  area  would  presumably  be  preferable  from  the  perspective  of  legal 
protection  for  our  technical  people).  Another  thought  I would  strongly  encourage  is  to  engage  the 
ISP.  That  is,  if  there  is  a technical  (filter)  failure  problem  regarding  the  interception,  it  would 
appear  to  be  much  much  more  preferable  for  the  ISP  to  try  to  fix  it  (even  with  us  coaching  and/  or 
guiding  technically  from  afar).  The  reason  for  fully  utilizing  the  ISP  is  the  existing  mandate  for 
their  assistance,  etc.  under  the  law,  and  because  of  the  “cover"  it  affords  us  legally,  politically, 
and  perceptionaliy. 


Issue  U 3: 


D1TU  poses  a similar  issue  as  to  one  its  own  “test”  accounts  where  an  inadvertent,  unauthorized 
interception  occurs.  Again,  we  have  to  be  very  careful  here,  even  where  “testing"  is  our  activity, 
because  the  potential  harm/violation  of  pri  vacy  is  arguably  the  same.  Somehow,  when  we  test, 
we  have  to  go  out  of  our  way  to  avoid  tripping  over  innocent  third  party  communications.  I am 
not  sure  how  we  can  proceed  to  test  without  inadvertently  intercepting  the-  communications  of 
others,  but  we  really  need  to  try.  Perhaps,  we  can  explain  our  testing  requirement  to  the  ISP  and 
get  them  to  test  our  filters,  etc.  for  us,  since  it  is  their  network,  and  since  they  administrate  it,  etc, 
anyway.  I would  really  encourage  using  the  ISPs  for  many  reasons,  not  the  least  of  which  is  to 
make  them  aware  of  us  popping  around  in  their  network  to  conduct  testing,  etc. 


Issue  #4: 

DITU  asks  whether  interception  collections  effected  in  Random  Access  Memory  (RAM)  (rather 
than  permanent  media)  make  any  significant  legal  difference.  In  short,  I would  say  probably  not 
as  a purely  legal  matter,  inasmuch  as  an  unauthorized  interception  is,  after  all,  an  unauthorized 
interception.  How,  having  said  that,  it  may  make  some  feel  better  that  the  potential  for  ongoing 
“use"  and  “disclosure”(through  some  permanent  storage  media)  may  be  somewhat  reduced  - but  I 
don’t  think  this  is  the  path  to  take.  As  alluded  to  above,  I would  opt  for  more  controlled  testing 
and  utilizing  sendee  providers  as  much  as  possible  to  create  some  insulation  between  us  and  the 
subscriber  public  where  inadvertent  interceptions  might  arise  in  the  course  of  our  trying  out  our 
filters,  etc. 
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FBI  Using  Internet  Wiretap  System  (washingtonpost.com) 

By  John  Schwartz 
Washington  Post  Staff  Writer 
Tuesday,  July  1 I , 2000;  Page  A1 

The  FBI  has  deployed  an  automated  system  to  wiretap  the  Internet,  giving 
authorities  anew  tool  to  police  cyberspace  but  drawing  concerns  among 
civil  libertarians  and  privacy  advocates  about  how  it  might  be  used. 

The  new  computer  system,  dubbed  "Carnivore”  inside  the  FBI  because  it 
rapidly  finds  the  "meat”  in  vast  amount  s of  data,  was  developed  at  FBI 
computer  labs  in  Quanttco,  Va.,  and  has  been  used  in  fewer  than  50  cases 
so  far. 

But  that  number  is  sure  to  rise,  said  Marcus  Thomas,  chief  of  the  FBI’s 
cyber-technology  section  at  Quantico.  ”In  criminal  situations  there’s  not 
yet  been  a large  cal!  for  it,"  he  said,  but  the  bureau  already  has  seen 
"growth  in  the  rate  of  requests.” 

Civil  liberties  groups  said  the  new  system  raises  troubling  issues  about 
what  constitutes  a reasonable  search  and  seizure  of  electronic  data.  In 
sniffing  out  potential  criminal  conduct,  the  new  technology  also  could 
scan  private  information  about  legal  activities. 

' it  goes  to  the  heart  of  how  the  Fourth  Amendment  and  the  federal  wiretap 
statute  are  going  to  be  applied  in  the  Internet  age,"  said  Marc  Rotenberg, 
head  of  the  Washington-based  Electronic  Privacy  Information  Center.  ' 

The  new  system,  which  operates  on  off-the-shelf  personal  computers,  takes 
advantage  of  one  of  the  fundamental  principles  of  the  Internet;  that 
virtually  all  such  communications  are  broken  up  into  "packets,”  or  uniform 
chunks  of  data.  Computers  on  the  Internet  break  up  e-mail  messages.  World 
Wide  W'eb  site  traffic  and  other  information  into  pieces  and  route  the 
packets  across  the  global  network,  where  they  are  reassembled  on  the  other 
end. 

FBI  programmers  devised  a "packet  sniffer"  system  that  can  analyze  data 
flowing  through  computer  networks  to  determine  whether  it  is  part  of  an 
e-mail  message  or  some  other  piece  of  Web  traffic. 

The  ability  to  distinguish  between  packets  allows  law  enforcement 
officials  to  tailor  their  searches  so  that,  for  example,  they  can  examine 
e-mail  but  leave  alone  a suspect’s  online  shopping  activities.  The  system 
could  be  tuned  to  do  as  little  as  monitoring  how  many  e-mail  messages  the 
suspect  sends  and  to  whom  they  are  addressed  u the  equivalent  of  a 
telephone  "pen  register,"  which  takes  down  telephone  numbers  being  called 
without  grabbing  the  content  of  those  calls. 

"That's  the  good  news,”  said  James  Dempsey,  an  analyst  with  the  Center  for 
Democracy  and  Technology,  a Washington  high-tech  policy  group.  "It  is  a 
more  discriminating  device"  than  a full  wiretap,  he  said. 

But  Dempsey  expressed  worries  about  the  new  system,  which  would  be 
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from  pen-register  data  to  Ml  wiretaps  with  court  authorization,  "It’s 
not  an  increase  in  our  authority;  it  doesn't  present  a change  of  volume  in 
what  we  do,"  he  said, 
r-  2000  The  Washington  Post  Company 
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FBI  e-mail  Snooping  Device  Attacked 


July  11,2000 

Filed  at  7:26  p.ra.  EDT 
By  The  Associated  Press 

WASHINGTON  (APj  — C nil  liberties  and  privacy  groups  railed  Tuesday 
against  a new  system  designed  to  allow  law  enforcement  agents  to 
intercept  and  analyze  huge  amounts  of  e-mail  in  connection  with  an 
investigation. 

The  system,  called  "Carnivore,"  was  first  hinted  at  on  April  6 in 
testimony  to  a House  subcommittee.  Now  the  FBI  has  it  in  use. 

When  Carnivore  is  placed  at  an  Internet  Service  Provider,  it  scans  all 
incoming  and  outgoing  e-mails  for  messages  associated  with  the  target 
of  a criminal  probe. 

In  a letter  addressed  to  two  members  of  the  House  subcommittee  that 
deals  with  Fourth  Amendment  search-and -seizure  issues,  the  American 
Civil  Liberties  Union  argued  that  the  system  breaches  the  Internet 
pro  vider's  rights  and  the  rights  of  all  its  customers  by  reading  both 
sender  and  recipient  addresses,  as  well  as  subject  lines  of  e-mails, 
to  decide  whether  to  make  a copy  of  the  entire  message. 

Further,  while  the  system  k plugged  into  the  Internet  provider's 
systems,  it  is  controlled  solely  by  the  law  enforcement  agency.  In  a 
traditional  wiretap,  the  tap  :s  physically  placed  and  maintained  by 
the  telephone  company. 

"Carnivore  is  roughly  equivalent  to  a wiretap  capable  of  accessing 
the  contents  of  the  conversations  of  all  of  the  phone  company's 
customers,  with  the  ’assurance*  that  the  FBI  will  record  only 
conversations  of  the  specified  target,"  read  the  letter.  "This 
'trust  us,  we  are  the  government'  approach  Is  the  antithesis  of  the 
procedures  required  under  our  wiretapping  laws." 

Batty  Steinhardt,  associate  director  of  the  ACLU,  said  citizens 
shouldn't  trust  that  such  a sweeping  data-tap  will  only  be  used 
against  criminal  suspects.  And  even  then,  he  said,  the  data  mined  by 
Carnivore,  particularly  subject  lines,  is  already  intrusive. 

"Law  enforcement  should  be  prohibited  from  installing  any  device  that 
allows  them  to  intercept  communications  from  persons  other  than  the 
target,”  Steinhardt  said  in  an  interview.  "When  conducting  these 
kinds  of  investigations,  the  information  should  be  restricted  to  only 
addressing  information." 

A spokeswoman  for  Rep.  Charles  T.  Canady,  R-Fla.,  who  heads  the 
Constitution  subcommittee,  said  that  the  congressman  had  no  immediate 
comment  on  the  Setter. 

In  testimony  to  Canady's  subcommittee,  Robert  Cora-Revere,  a lawyer  at 
the  Hogan  & Hartson  law  firm  in  Washington,  said  that  he  represented 
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an  Internet  provider  that  refused  to  install  the  Carnivore  system.  The 
provider  was  placed  in  an  “awkward  position,"  Com-Revere  said, 
because  the  company  feared  suits  from  customers  unhappy  with  the 
government  looking  in  to  all  the  e-mail. 

“It  was  acknowledged  (by  the  government)  that  Carnivore  would  enable 
remote  access  to  the  ISP’s  network  and  would  be  under  the  exclusive 
control  of  government  agents,"  Com-Revere  said, 

Com-Revere  told  the  committee  that  current  law  is  insufficient  to 
deal  with  Carnivore's  potential  and  that  the  Internet  provider  lost 
their  court  battle  in  part  because  of  the  Internet’s  connection  to 
telephone  lines,  and  that  the  law  was  stretched  to  cover  the  Internet 
as  well. 

Com-Revere  would  not  reveal  the  name  of  his  client,  and  the  client 
lost  the  case.  He  said  that  the  FBI  has  been  using  Carnivore  since 
early  this  year. 

James  X.  Dempsey,  senior  staff  counsel  at  die  Center  for  Democracy  and 
Technology,  said  that  the  main  problem  with  Carnivore  is  it’s  mystery. 

“The  FBI  is  placing  a black  box  inside  the  computer  network  of  an 
ISP,"  Dempsey  said.  “Not  even  the  ISP  knows  exactly  what  that  gizmo 
is  doing." 

But  Dempsey  said  that  Internet  providers  contributed  to  the  problem, 
by  saying  that  current  technology  does  not  allow  the  Internet  provider 
to  sort  out  exactly  what  the  government  is  entitled  to  get  under  a 
search  warrant.  The  carriers  complained  that  they  had  to  give 
everything  to  the  FBI. 

“The  service  providers  said  they  didn't  know  how  to  comply  with  court 
orders,"  Dempsey  said.  “By  taking  that  position,  they  have  hurt 
themselves,  putting  themselves  into  a box," 

Marcus  Thomas,  who  heads  the  FBI’s  Cyber  Technology  Section,  told  the 
Wall  Street  journal  that  the  bureau  has  about  20  Carnivore  systems, 
which  are  PCs  with  proprietary  software.  He  said  Carnivore  meets 
current  wiretapping  laws,  but  is  designed  to  keep  up  with  the 
Internet. 

“This  is  just  a specialized  snifter,"  Thomas  told  the  Journal,  which 
first  reported  details  about  Carnivore. 

Encrypted  e-mail,  done  with  an  e-mail  encoding  program  like  POP,  still 
stays  in  code  on  Carnivore,  and  it's  up  to  agents  to  decode  it. 

Dempsey  has  a possible  solution  to  the  problem,  though  one  that’s 
probably  unlikely  — show  everyone  what  it  does  and  how  it  does  it, 
allowing  internet  providers  to  install  the  software  themselves. 

“The  FBI  should  make  this  gizmo  an  open-source  product,"  he  said, 
“Then  the  secret  is  gone," 


On  the  Net:  Federal  Bureau  of  Investigation:  http://www.fbi.gov 
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American  Civil  Liberties  Union:  http://wvAv.aclti.org 
Center  for  Democracy  and  Technology  : http://www.cdt.oiB 
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FBI’s  system  to  covertly  search 
e-mail  raises  privacy,  legal  issues 

By  Neil  King  Jr,  and  Ted  Bridis 

Washington,  July  u — The  U.S.  Federal  Bureau 
of  Investigation  is  using  a superfast  system 
called  Carnivore  to  covertly  search  e-mails  for 
messages  from  criminal  suspects. 
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ESSENTIALLY  A PERSONAL  COMPUTER 
stuffed  with  specialized  software.  Carnivore  represents 
a new  twist  in  the  federal  government’s  fight  to  sustain 
its  snooping  powers  in  the  Internet  age.  But  in 
employing  the  system,  which  can  scan  millions  of 
e-mails  a second,  the  FBI  has  upset  privacy  advocates 
and  some  in  the  computer  industry.  Experts  say  the 
system  opens  a thicket  of  Unresolved  legal  issues  and 
privacy  concerns. 

The  FBI  developed  the  Internet  wiretapping  system 
at  a special  agency  tab  at  Quantico,  Va„  and  dubbed  it 
Carnivore  for  its  ability  to  get  to  “the  meat”  of  what 
would  otherwise  be  an  enormous  quantity  of  data.  FBI 
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Word  of  the 
Carnivore  system 
has  disturbed  many 
in  the  Internet 
industry  because, 
when  deployed,  it 
must  be  hooked 
directly  . into  Internet 
service  providers’ 
computer  networks. 


technicians  unveiled  the  system  to  a roomful  of 
astonished  industry  specialists  here  two  weeks  ago  in 
order  to  steer  efforts  to  develop  standardized  ways  of 
complying  with  federal  wiretaps.  Federal  investigators 
say  they  have  used  Carnivore  in  fewer  than  100  criminal 
cases  since  its  launch  early  last  year. 

Word  of  the  Carnivore  system  has  disturbed  many 
in  the  Internet  industry  because,  when  deployed,  if  must 
be  hooked  directly  into  Internet  service  providers’ 
computer  networks.  That  would  give  the  government,  at 
least  theoretically,  the  ability  to  eavesdrop  on  al! 
customers'  digital  communications,  from  e-mail  to 
online  banking  and  Web  surfing. 

The  system  also  troubles  some  Internet  service 
providers,  who  are  loath  to  see  outside  software  plugged 
into  their  systems.  In  many  cases,  the  FBI  keeps  the 
secret  Carnivore  computer  system  in  a locked  cage  on 
the  provider’s  premises,  w ith  agents  making  daily  visits 
to  retrieve  the  data  captured  from  the  provider’s 
network.  But  legal  challenges  to  the  use  of  Carnivore 
arc  few,  and  judges’  rulings  remain  sealed  because  of 
the  secretive  nature  of  the  investigations. 

Internet  wiretaps  are  conducted  only  under  state  or 
federal  judicial  order,  and  occur  relatively  infrequently. 
The  huge  majority  of  wiretaps  continue  to  be  the 
traditional  telephone  variety,  though  U.S,  officials  say 
the  use  of  Internet  eavesdropping  is  growing  as 
everyone  from  drug  dealers  to  potential  terrorists  begins 
to  conduct  business  over  the  Web. 


Mews  from  the  WSJ 


Walt  Street  Journal 
stories  on  MSNBC 


1 he  rBI  defends 
Carnivore  as  more 
precise  than  Internet 
wiretap  methods  used  in 
the  past.  The  bureau 
says  the  system  a!  low's 
investigators  to  tailor  an 
intercept  operation  so  they  can  pluck  only  the  digital 
traffic  of  one  person  from  among  the  stream  of  millions 
of  other  messages.  An  earlier  version,  aptly  code-named 
Omnivore,  could  suck  in  as  much  as  to  six  gigabytes  of 
data  every  hour,  but  in  a less  discriminating  fashion. 

Still,  critics  contend  that  Carnivore  is  open  to 
abuse. 


Mark  Rasch,  a former  federal  computer-crimes 
prosecutor,  said  the  nature  of  the  surveillance  by 
Carnivore  raises  important  pri  vacy  questions,  since  it 
analyzes  part  of  every  snippet  of  data  traffic  that  flows 
past,  if  only  to  determine  whether  to  record  it  for  police. 
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“It’s  the  electronic 
equivalent  of 
listening  to 
everybody’s  phone 
calls  to  see  if  it’s' the 
phone  call  you 
should  be 
monitoring,”  Mr. 
Rasch  said.  “You 
develop  a 

tremendous  amount 
of  information.” 


“It’s  the  electronic  equivalent  of  listening  to 
everybody’s  phone  calls  to  see  if  it's  the  phone  call  you 
should  be  monitoring,”  Mr.  Rasch  said.  “You  develop  & 
tremendous  amount  of  information.” 

Others  say  the  technology  dramatizes  how  far  the 
ration’s  laws  are  lagging  behind  the  technological 
revolution.  “This  is  a clever  way  to  use  old 
telephone-era  statutes  to  meet  new  challenges,  but 
clearly  there  is  too  much  latitude  in  the  current  law  ” 
said  Stewart  Baker,  a lawyer  specializing  in 
telecommunications  and  Internet  regulatory  matters. 

Robert  Coin  -Revere,  of  the  Hogan  & Hanson  law 
firm  here,  represented  an  unidentified  Internet  service 
provider  in  one  of  the  few  legal  fights  against 
Carnivore.  He  said  his  client  worried  that  the  FBI  would 
have  access  to  all  the  e-mail  traffic  on  its  system,  raising 
dire  pri  vaev  and  security  concerns.  A federal  magistrate 
ruled  against  the  company  early  this  year,  leaving  it  no 
option  but  to  allow  the  FBI  access  to  its  system. 

“This  is  an  area  in  desperate  need  of  clarification 
from  Congress  ” said  Mr.  Corn-Re  vere. 

“Once  the  software  is  applied  to  the  ISP,  there’s  no 
check  on  the  system,”  said  Rep.  Bob  Barr  (R.,  Ga.), 
who  sits  on  a House  judiciary  subcommittee  for 
constitutional  affairs.  “If  there’s  one  word  I would  use 
to  describe  this,  it  would  be  ‘frightening.”’ 

Marcus  Thomas,  chief  of  the  FBI’s  Cyber 
Technology  Section  at  Quamieo,  said  Carnivore 
represents  the  bureau’s  effort  to  keep  abreast  of  rapid 
changes  in  Internet  communications  while  still  meeting 
the  rigid  demands  of  federal  wiretapping  statutes.  “This 
is  just  a very  specialized  sniffer,”  be  said. 

He  also  noted  that  criminal  and  civil  penalties 
prohibit  the  bureau  from  placing  unauthorized  wiretaps, 
and  any  information  gleaned  in  those  types  of  criminal 
cases  would  be  thrown  out  of  court.  Typical  Internet 
wiretaps  last  around  45  day's,  after  which  the  FBI 
remov  es  the  equipment,  Mr.  Thomas  said  the  bureau 
usually  has  as  many  as  20  Carnivore  systems  on  hand, 
“just  in  case.” 
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FBI  experts  acknowledge  that  Carnivore's 
monitoring  can  be  stymied  with  computer  data  such  as 
e-mail  that  is  scrambled  using  powerful  encryption 
technology.  Those  messages  still  can  be  captured,  but 
law  officers  trying  to  read  the  contents  are  "at  the  mercy 
of  how  well  it  was  encrypted  ^ Mr,  Thomas  said. 

Most  of  the  criminal  cases  where  the  FBI  used 
Carnivore  in  the  past  I S months  focused  on  what  the 
bureau  calls  ^infrastructure  protection  ” or  the  hunt  for 
hackers,  though  it  also  was  used  m eountenerrorism  and 
some  drug-trafficking  cases. 
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News  Burst:  FBI  uses  covert  email  surveillance  system 


Tue,  11  Jul  2000  16:21:36  GMT 
Will  Knight 

A super-fast  scanning  system  nicknamed  'Carnivore*  is  being  used  by  the  FBI 
to  covertly  search  through  email  messages,  says  the  Wall  Street  Journal 

America's  Federal  Bureau  of  Investigation  (FBI)  is  using  a super-fast  email 
scanning  system  dubbed  "Carnivore”  to  covertly  trawl  through  email  messages 
in  order  to  capture  suspected  criminals,  reports  the  Wall  Street  Journal 
Tuesday. 


The  revelations  have  caused  a furore  among  privacy  and  security  advocates, 
because  it  requires  a direct  connection  to  a commercial  ISP's  network, 
giving  the  authorities,  in  theory,  access  to  ail  Internet  communications. 

Carnivore  is  reportedly  nothing  more  than  a personal  computer  fitted  with 
special  software  capable  of  scanning  millions  of  emails  in  a second. 

According  to  the  WSJ's  report  Carnivore,  which  was  launched  last  year,  has 
been  used  to  gather  evidence  in  fewer  than  1 00  criminal  cases. 


5/24/62  Release  - Page  62' 

~2)  o C-  **/<£-* 


07/1 1/2000 


C.  -J 


FBI  e-mail  Snooping  Device  Attacked 

I 

< By  D.  IAN  HOPPER 

f .c  The  Associated  Press 

WASHINGTON  (AP)  - Civil  liberties  and  privacy  groups  are  railing  against  a new  system 
designed  to  allow  law  enforcement  agents  to  intercept  and  analyze  huge  amounts  of  e-mail  in 
connection  with  an  investigation. 

The  system,  called  "Carnivore,"  was  first  hinted  at  on  April  6 in  testimony  to  a House 
subcommittee.  Now  the  FBI  has  it  in  use. 

When  Carnivore  is  placed  at  an  Internet  sendee  provider,  it  scans  all  incoming  and  outgoing 
e-mails  for  messages  associated  with  the  target  of  a criminal  probe. 

In  a letter  addressed  to  two  members  of  the  House  subcommittee  that  deals  with  Fourth 
Amendment  search-and-setzure  issues,  the  American  Civil  Liberties  Union  argued  that  the 
system  breaches  the  Internet  provider's  rights  and  the  rights  of  all  its  customers  by  reading  both 
sender  and  recipient  addresses,  as  well  as  subject  lines  of  e-mails,  to  decide  whether  to  make  a 
copy  of  the  entire  message. 

Further,  while  the  system  is  plugged  into  the  Internet  provider's  systems,  it  is  controlled  solely  by 
the  law  enforcement  agency.  In  a traditional  wiretap,  the  tap  is  physically  placed  and  maintained 
by  the  telephone  company. 

"Carnivore  is  roughly  equivalent  to  a wiretap  capable  of  accessing  the  contents  of  the 
conversations  of  all  of  the  phone  company's  customers,  with  the  'assurance'  that  the  FBI  will 
record  only  conversations  of  the  specified  target,”  read  the  letter.  "This  ’trust  us,  vve  are  the 
government'  approach  is  the  antithesis  of  the  procedures  required  under  our  wiretapping  laws." 

Barry'  Steinhardt,  associate  director  of  the  ACLU,  said  citizens  shouldn't  trust  that  such  a 
sweeping  dala-tap  will  only  be  used  against  criminal  suspects.  And  even  then,  he  said,  the  data 
mined  by  Carnivore,  particularly  subject  lines,  are  already  intrusive. 

"Law  enforcement  should  be  prohibited  from  installing  any  device  that  allows  them  to  intercept 
communications  from  persons  other  than  the  target,"  Steinhardt  said  in  an  interview.  "When 
conducting  these  kinds  of  investigations,  the  information  should  be  restricted  to  only  addressing 
information," 

A spokeswoman  for  Rep.  Charles  T.  Canady,  R-Fla.,  who  heads  the  House  Judiciary 
subcommittee  on  tire  Constitution,  said  the  congressman  had  no  comment  on  the  letter. 

In  testimony  to  Canady's  subcommittee,  Robert  Corn-Revere,  a lawyer  at  the  Hogan  & Hartson 
law  firm  in  Washington,  said  he  represented  an  Internet  provider  that  refused  to  install  the 
Carnivore  system.  The  provider  was  placed  in  an  "awkward  position,”  Corn-Revere  said, 
because  the  company  feared  suits  from  customers  unhappy  with  the  government  looking  into  all 
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"It  was  acknowledged  (by  the  government)  that  Carnivore  would  enable  remote  access  to  the 
ISP's  network  and  would  be  under  the  exclusive  control  of  government  agents,"  Com-Revere 
said. 

Com-Revere  told  the  committee  that  current  law  is  insufficient  to  deal  with  Carnivore’s  potential 
and  that  the  Internet  provider  lost  its  court  battle  in  part  because  of  the  Internet’s  connection  to 
telephone  lines,  and  that  the  law  was  stretched  to  cover  the  Internet  as  well. 

Com-Revere  would  not  reveal  the  name  of  his  client,  and  the  client  lost  the  case.  He  said  the  FBI 
has  been  using  Carnivore  since  early  this  year. 

James  X.  Dempsey,  senior  staff  counsel  at  the  Center  for  Democracy  and  Technology,  said  the 
main  problem  with  Carnivore  is  its  mystery. 

"The  FBI  is  p lac  ing  a black  box  inside  the  computer  network  of  an  ISP,"  Dempsey  said,  "Not 
even  the  ISP  knows  exactly  what  that  gizmo  is  doing." 


But  Dempsey  said  Internet  providers  contributed  to  the  problem,  by  saying  that  current 
technology  does  not  allow  the  Internet  provider  to  sort  out  exactly  what  the  government  is 
entitled  to  get  under  a search  warrant.  The  carriers  complained  that  they  had  to  give  everything  to 
the  FBI. 

"The  service  providers  said  they  didn’t  know  how  to  comply  with  court  orders,”  Dempsey  said, 
"By  taking  that  position,  they  have  hurt  themselves,  putting  themselves  into  a box." 


Marcus  Thomas,  who  heads  the  FBI’s  cyberteehnology  section,  told  the  Wail  Street  Journal  that 
the  bureau  has  about  20  Carnivore  systems,  which  are  PCs  with  proprietary  software.  He  said 
Carnivore  meets  current  wiretapping  laws,  but  is  designed  to  keep  up  with  the  Internet. 


"This  is  just  a specialized  sniffer,"  Thomas  told  the  Journal,  which  fi  rst  reported  details  about 
Carnivore. 

Encrypted  e-mail,  done  with  an  e-mail  encoding  program  like  PGP,  still  stays  in  code  on 
Carnivore,  and  it’s  up  to  agents  to  decode  it, 

Dempsey  has  a possible  solution  to  the  problem,  though  one  that’s  probably  unlikely  - show 
everyone  what  it  does  and  how  it  does  it,  allowing  Internet  providers  to  install  the  software 
themselves. 

"The  FBI  should  make  this  gizmo  an  open-source  product,”  he  said.  "Then  the  secret  is  gone." 
On  the  Net:  Federal  Bureau  of  Investigation:  http://www.foi.gov 


American  Civil  Liberties  Union:  http://ww.aclu.org 
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FBI's  Internet  Wiretaps  Raise  Privacy  Concerns 

By  John  Sch  wartz 

Washingfon  Post  Staff  Writer  * Privacy  Special  Report 

Tuesday,  July  1 1 1 2000;  Page  A01 


The  FBI  has  deployed  an  * 

automated  system  to  wiretap  the 

Interne^  giving  authorities  a new  ^=?E-Mah  this  Artigt^ 

tool  to  police  cyberspace  but  ^ Prin^r-fdRp^ers^r, 

drawing  concerns  among  civil  ' 

libertarians  and  privacy  advocates  about  how  it  might  be  used. 
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The  new  computer  system,  dubbed  "Carnivore"  inside  the  FBI  because  it  ff  « 
rapidly  finds  the  "meat"  in  vast  amounts  of  data,  was  developed  at  FBI  r 
computer  labs  in  Quarstico,  Va.,  and  has  been  used  in  fewer  than  50  . , 

cases  so  far  . m~ 

But  that  number  is  sure  to  rise,  said  Marcus  Thomas,  chief  of  the  FBI’s  w ><e  t 

cyber-technology  section  at  Quantico.  "In  criminal  situations  there's  not 
yet  been  a large  call  for  it,"  he  said,  but  the  bureau  already  has  seen  f.rin 

"growth  in  the  rate  of  requests.”  * ^ew 

Coun 

yu&ct. 

Civil  liberties  groups  said  the  new  system  raises  troubling  issues  about 
what  constitutes  a reasonable  search  and  seizure  of  electronic  data,  in  iq-fr 

sniffing  out  potential  criminal  conduct,  the  new  technology  also  could 
scan  private  information  about  leeal  activities.  ' Tm£- 

Amo. 

^ Horn] 

*li  goes  to  the  heart  of  how  the  Fourth  Amendment  and  the  federal  gpM 

wiretap  statute  are  going  to  be  applied  in  the  Internet  age,"  said  Marc  «?<w 

Rotenberg,  head  of  the  Washington-based  Electronic  Privacy 
Information  Center.  Mars. 

New.. 

The  new'  system,  which  operates  on  off-the-shelf  personal  computers, 
takes  advantage  of  one  of  the  fundamental  principles  of  the  Internet:  that 
virtually  all  such  communications  are  broken  up  into  "packets,"  or 
uniform  chunks  of  data.  Computers  on  the  Internet  break  up  e-mail 
messages.  World  Wide  Web  site  traffic  and  other  information  into  pieces 
and  route  the  packets  across  the  global  network,  where  they  are 
reassembled  on  the  other  end. 

FBI  programmers  devised  a "packet  sniffer"  system  that  can  analyze  data 
flowing  through  computer  networks  to  determine  whether  it  is  part  of  an 
e-mail  message  or  some  other  piece  of  Web  traffic.  mm%  Releaw  _ me  $33 
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The  ability  to  distinguish  between  packets  allows  law  enforcement 
officials  to  tailor  their  searches  so  that,  for  example,  they  can  examine  e- 
mail  but  leave  alone  a suspect's  online  shopping  activities.  The  system 
could  be  tuned  to  do  as  little  as  monitoring  how  many  e-mail  messages 
the  suspect  sends  and  to  whom  they  are  addressed— the  equivalent  of  a 
telephone  "pen  register,"  which  takes  down  telephone  numbers  being 
called  without  grabbing  the  content  of  those  calls. 

“That’s  the  good  news,"  said  James  Dempsey,  an  analyst  with  the  Center 
for  Democracy  and  Technology,  a Washington  high-tech  policy  group. 
“It  is  a more  discriminating  device”  than  a foil  wiretap,  he  said. 

But  Dempsey  expressed  worries  about  the  new  system,  which  would  be 
installed  at  the  offices  of  a suspect's  Internet  service  provider.  Just  as  the 
device  could  be  used  to  fine-tune  a search,  it  also  could  used  for  broad 
sweeps  of  data.  "The  bad  news  is  that  it's  a black  box  the  government 
wants  to  insert  into  the  premises  of  a service  provider.  Nobody  knows 
that  it  does  what  the  government  claims  it  would  do,"  Dempsey  said. 

Existence  of  the  Carnivore  system  was  discussed  in  a Wall  Street 
Journal  article  yesterday,  which  reported  that  the  FBI  showed  the  system 
to  telecommunications  industry  experts  two  weeks  ago. 

Albert  Gidari,  a lawyer  who  works  for  the  wireless  industry,  was  present 
at  the  FBI  demonstration.  He  said  the  FBI’s  announcement  was  intended 
to  counter  industry'  assertions  that  it  would  be  very  difficult  to  provide 
the  kind  of  pen-register  wiretap  capability  that  the  agency  wants. 

Since  the  demonstration,  Gidari  said,  one  faction  within 
telecommunications  industry  was  pleased  with  the  FBI's  efforts.  But 
Gidari  said  the  other  faction  was  saying:  "Wait  a minute— what  are  the 
liability  issues?  What  are  the  privacy  issues?  We  don’t  want  third-part v 
software  on  our  system." 

Although  Congress  has  passed  legislation  requiring  telephone  companies 
to  make  their  developing  high-tech  networks  easy  to  wiretap,  Gidari  is 
one  of  a large  number  of  industry  experts  who  believe  the  law  does  not 
apply  to  wiretapping  the  Internet,  "The  FBI  overreaches  in  everything 
they  do,"  said  Gidari,  who  is  president  of  G- Savvy,  an  Internet  * 
consulting  company. 

A former  federal  prosecutor  sounded  a more  supportive  tone.  “If  what  it 
does  is  it  helps  comply  with  wiretaps,  and  it  helps  minimize  what  you're 
getting— to  help  get  what  the  court  authorizes  you  to  get— there's  nothing 
wrong  with  it,"  said  Mark  Rasch,  now  a security  consultant  with  Reston- 
based  Global  Integrity. 

Still,  Rasch  said  the  technology  raised  questions  that  have  yet  to  be  fully 
explored  by  law  enforcement.  The  PC  robocop  examines  all  packets 
coming  through  a computer  network  but  gives  live  law  enforcement 
officers  only  those  packets  related  to  the  subject  of  the  investigation. 

"The  stuff  that  is  exami  ned  only  by  a computer  and  not  by  a human 
being— was  that  information  searched?”  Rasch  asked.  He  then  suggested 
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an  answer:  "It  is  a search,  but  it  is  to  an  extent  less  invasive  than  it  would 
be  it  you  dtd  not  use  this  technology." 

SfimSv  hv! \vf  ?m!VOrf  aCtuaIny  fame  5n  APril  durin8  congressional 
testimony  by  Washington  lawyer  Robert  Com-Revere,  who  represented 

an  Internet  service  provider  that  tried  to  resist  attaching  the  system  to  its 
network.  Com-Revere  suggested  that  such  a system  could  be  used  to 
track  dissidents  and  journalists  online.  "There  are  some  human  rights 
issues  here,’ he  said.  b 

But  Thomas  of  the  FBI  said  there  is  nothing  mysterious  about  the  new 

ilt  wi  1 35  an.eff?rt  on  the  FBI's  part  to  keep  pace  with  changes  in 

technology-to  maintain  our  ability"  to  lawfully  intercept  everything 
from  pen-register  data  to  Ml  wiretaps  with  court  authorization.  "It’s  not 

wfcaTv^o  h d°SSn  t pfeSCW  2 c!iange  °f  volume  in 
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Get  credit  for  that  old  IBM  PC,  lapto 


BY  PAVLA  SHAHI  T mmiZ 

Federal  agencies  will  be  able  to  ob- 
tain credit  toward  the  purchase 
of  new  IBM  Corp.  PCs  and  Up- 
tops  by  donating  their  old  computers  to 
charity  via  a unique  governmentwide 
contract. 

The  Department  ofVeteram  Affairs 
Special  Services  office  and  the  Air  Force 
Medical  Logistics  Office  awarded  a de-  \ 
centralized  blanket  purchase  agreement  j 
last  week  to  iGov.com,  an  online  com-  \ 
pmei  equipment  reseller,  that  would  ai-  • 
low  government  customers  to  receive  a 
trade-in  allowance  for  their  older  IBM  ? 


federal  agencies'  obsolete  systems  and 
deliver  them  to  charitable  organizations. 

Agencies  can  specify  a charity  or  al- 
low Gifts  In  Kind  to  choose  the  charity 
that  will  receive  the  computer.  Gifts  In 
Kind's  Recycle  Technology  program, 
which  supplies  refurbished  computers 
to  needy  organizations,  has  donated 
about  20,000  computers  a year  to  non- 
proOt  organizations  since  it  started  in 


1994,  said  Doug  McAllister,  Gifts  , 
Rmd*$  director  of  marketing  and  con 
munications,  "Computers  and  teehne 
am  high  on  the  needs  list  for  char 
tyC  McAllister  said. 

Responsibility  for  deleting  classify 
information  from  computer  hard  drN 
or  removing  the  ted  drives  themselve 
rests  with  the  agency  trading  In  th 
equipment,  Mack  said.  * 


equipment  at  the  tim  e of  purchase. 

Agencies  could  receive  a $300  credit 
for  IBM  PCs  that  have  486  or  faster 
processors  and  are  Year  zoo-o-compHani, 
said  Connne  Lingebach.  IGovconfs  pro- 
gram manager  for  the  Technical  Refresh 
and  Trade-In  program  , which  is  open  to 
all  government  agencies  and  runs 
rnrough  Oct.  Sv  200*.  The  credit  can  be 
applied  to  the  purchase  of  a new  com- 
puter Agencies  could  receive  a $500  cred- 
it for  each  laptop  turned  in. 

The  BFA,  based  on  iGov.com's  Gener- 
al Sendees  Administration  schedule  con- 
tract, “Is  a better  value,  and  it  enhances 
programs  we  already  have,1  said  govern- 
ment  contracting  officer  Mary  Rust. 
"Only  iOov  offers  the  trade-in,  so  h% 
unique." 

The  contract  guarantees  IGov.com  at  I 
least  $500,000  in  sales,  bur  the  company  I 
anticipates  more  than  $25  million  in  sales  I 
over  the  life  of  the  contract,  said  Brad  j 
Mack,  IGovcom’s  vice  president  of  sales.  j 
In  the  future.  Rust  hopes  to  add  oth-  ! 
er  types  of  compu  ter  equipment  to  the  I 
program.  Although  there  are  no  other  j 
contracts  that  offer  trade-in  credits,  I 
Rust's  office  does  offer  other  unique 
programs  that  benefit  schools  and  oth- 
er charities. 

IGov.com  partnered  with  Gifts  In 
Kind  International,  an  Alexandria,  Va,~ 
based  charity  organization,  to  refurbish 


ACLU:  Block  FBI  e-snoops 


; ev  DAM  VERTON 

The  American  Civil  Liberties 
Union  appealed  to  Congress  last 
week  to  protect  America  ns  f fom 
I unreasonable  searches  and  seizures  on 
5 Internet  in  light  of  recent  revela  tions 

; that  3 new  monitoring  tool  could  enable 
| lh<?  FBI  to  intercept  the  e-mail  of  la  w- 
l abiding  citizens, 

!:  In  a letter  to  the 

■ House  Judiciary  Com- 
1 mittee's  Constitution 
| Subcommittee  ACLU 
■ director  Laura  Mur- 
l P>hy  argued  that  the 
l FBI  s new  Carnivore  e-mail  surveillance 
j system  gives  federal  law  enforcement  of- 
\ Leers  access  to  the  e-mail  of  every  eus- 
I comer  of  an  Internet  service  provider  and  | 
the  e-mail  of  every  person  who  commu- 
nicates with  them, 

Tht  Carnivore  system  gives  law  en- 
forcement e-mail  interception  capabili- 
ties that  were  never  contemplated  when 
Congress  passed  the  Electronic  Com- 
munications Privacy  ActM  in  1986,  Mur- 
phy stated  in  die  letter.  “The  ACLU  urges 
the  subcommittee  to  accelerate  its  con-  I 
siderarion  of  the  application  of  the 
Fourth  Amendment  in  the  Digital  Age,” 
The  Fourth  Amendment  to  the  Con-  ; 
stitution  protects  the  public  from  un- 
reasonable searches  and  seizures.  ; 
Attorney  General  Janet  Reno  said  July 


j 13  that  she  is  now  looking  Into  the  alle 
> gat  ions.  "When  we  develop  new  tech 
| mlm\  when  we  apply  the  Consrimtiod 
I 3 want  to  make  sure  that  we  apply  it  in 
| 3 consistent  and  balanced  way”  Rene 
j said, 

Robert  Corn- Revere,  m Internet  and 
* commute*  dons  lawyer  with  the  Wash- 
ington, DX. -based 
lav/  firm  Hogan  & 
Hanston  LLP,  first  di- 
vulged evidence  of 
? tke  Carnivore  sys- 
tem's abilities  during 
a congressional  hear- 
j April  The  FBI  mus  t have  a court 
| order  to  use  Carnivore, 
j ^nce  approved,  Carnivore  is  attached 
directly  to  an  ISP's  network  and  gives 
the  FBI  access  to  ail  e-mail  traffic  flow- 
ing across  the  network*  according  to  the 
: ACLU,  The  ACLU  and  others  have  raised 
concerns  that  Carnivore  intercepts  in- 
formation from  the  headers  of  e-mail 
messages  and  may  divulge  details  about 
the  contents  of  the  messages. 

The  FBI  and  the  law'  enforcement  . 
and  national  security  communities  in 
general  are  offering  a trade:  less  privacy 
due  to  increased  use  of  technology  in  sur- 
veillance in  return  for  greater  safety  for 
the  public,"  said  Daniel  Ryan,  a lawyer 
and  former  director  of  Information  Sys- 
tems Security  at  the  Pentagon,  m 
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Intel!  turf  battles  rage 


by  cm  VERTOV  j about  the  impact  the  new  office  might 

Major  portions  of  a hill  that  j have  on  DOD's  efforts  to  orchestrate  a 
wom  authorize  appropriations  J Global  information  Grid  (GIG),  accord- 
for  the  US,  intelligence  com-  I mo  m the  Cnhon  *nA  w*v  *ru» 


if  I for  the  US,  intelligence  com- 
munity would  significantly  limit  the  De- 
fense Department's  ability  to  support 
military  operations,  warn 
Defense  Secretary  William 
Cohen  and  his  top  military 
adviser. 

Cohen  and  Army  Gen. 

Henry  Shel  ton,  chairman  of 
the  Joint  Chiefs  of  Staff  re- 
cently sent  a tetter  to  senior 
lawmakers  on  Capitol  Hill 
protesting  a proposal  by  the 
House  Permanent  Select 
Committee  on  Intelligence 
to  establish  an  intelligence  M 

community  ccminunicarions  Sectary  < 
architect  position  within  the  Cl  A.  The 
chief  architect  would  have  broad  re- 
sponsibilities for  the  development  of  a 
worldwide  telecommunications  system 
that  would  serve  the  intelligence  com- 
munity, the  bulk  of  which  now  resides 
in  BOD  and  not  the  CIA, 

The  chief  architect,  supported  by  a 30- 
person  staff  would  be  funded  with 
million  in  start-up  money  taken  direct- 
ly from  the  budgets  of  the  Pentagons  Na- 
tional Reconnaissance  Office,  the  Na- 
tional Security  Agency  and  the  Defense 
Intelligence  Agency;  seconding  to  the  bill 
‘This  unilateral  and  independent  ar- 
chitectural office  would  seriously  dam- 
age, if  not  totally  destroy  the  efforts  of  | 


jence  com-  mg  to  the  Cohen  and  Shelton  letter.  The 
nit  the  Be-  : Pentagon  has  been  working  on  the  GIG 
to  support  concept  for  more  than  a year  and  envi- 
sions a global  network  capa- 
ble of  deli  vering  secure  in- 
formation to  all  users. 

The  GIG  architecture  splits 
a premium  cm  the  assured 
and  timely  access  by  our 
warfighters  and  policy-mak- 
ers to  all  forms  of  informa- 
tion, including  intelligence^ 
a Pentagon  spokesperson 
said  However/'ihere  should- 
n't be  separate  architecmres 
Wiliam  Cohen*  for  combat  functions,  for 

Sec  W of  Defence  suppofi  fmeti^  [or|  forta. 

Cl  A.  The  | tdiigence  functions.  Otherwise,  we'ie 
broad  re-  $ back  at  the  srovepiped,  stand-alone  sys- 
merit  of  a ?■  tents  that  don't  talk  to  one  another  in  a 
ns  system  j timely  fashion f 
mce  com-  j An  official  from  the  Pentagon's  office 
w resides  j oi  Command,  Control,  Conurrunications 
| and  Intelligence  also  said  that  the  Pen- 
d by  a 30-  : tagon  supports  a broader  GIG  concept  as 
with  $80  j opposed  to  a narrow;  Intel  iigencc-only 
5X1  direct-  j communications  architecture. 

igons  Na-  j r“““~  — — — — “~ 

the  nv  I A WAR,  NOT  A BATTLE 

- Defense  j intelligence  experts  characterized  the 
0 the  bill  j latest  report  m the  bill  from  the  House 
ndentar-  j Armed  Services  Committee  as  little  more 
isly  dam-  than  a tool  in  the  struggle  for  control 
efforts  of  j | over  the  Intelligence  budget  between  the 


the  DOD  chief  information  officer,  who  j j House  and  t he  Senate  Select  Committee 
has  ongoing  activities  with  the  (mtellb  j on  intelligence,  chaired  by  Sen,  Richard 


gence  community]  and  Defense  intelli- 
gence component  CIOs  to  advance  in- 
teroperability between  and  among 
intelligence  producers  and  consumers,” 
Cohen  and  Shelton  told  Congress.  The 
House  Armed  Services  Committee  in- 
cluded Cohen  and  Shelton's  tetter  in  a re- 
port on  the  fiscal  2001  Intelligence  Au- 
thorization hill,  released  last  month. 

But  the  Pentagon  is  also  concerned 

f t'PISAl  COMFOTER  W £ £ K 


Others  said  the  debate  canters  on  the 
larger  questions  of  reforming  the  Intem- 
gence  community  and  who  should  be  In 
charge; 

-It  just  one  mom  Instance  of  the  tort 
bathe  over  Intelligence/'  said  Steven 
Aftergood,  an  intelligence  specialist  with 
t he  Federation  of  American  Scientists.. 


'"Solutions  which  take  down  the  old 
barriers  to  interoperability  and  harness 
I our  collaborative  networking  and  com- 
puting capabilities  have  the  most  value 
E : and  are  deserving  of  support  ” the  off*- 
i cial  said.  "Our  concerns  with  the  pro- 
* I posed  intelligence  communications  or- 

■ chitect  are  lessened  by  the  extent  to 
! which  that  entity  is  free  to  support  the 

■ j broader  Global  Information  Grid  arehi- 
| teernre  in  preference  to  a narrower,  in- 
| telhgence-only  network  ” 

I Cohen  and  Shelton  expressed  opposi- 
j tion  to  Congress"  proposal  to  expedite 
] the  real-world  use  of  the  Joint  IntelU- 
| gence  Virtual  Ajclutecrure  tool  in  the  in- 
| telligence  community,  saying  it  is  "pre- 
; mature”  to  designate  the  software 
j capability  as  the  community  standard 
i for  collaboration.  The  program  is  a next- 
| generation  digital  collaboration  effort 
| headed  up  by  Defense  Intelligence 
i Agency.  Congress  called  for  oversight  of 

t ^ c? 

j the  program  to  be  transferred  from  DOD 
| to  the  CIA, 

| ”We  feel  strongly  that  it  would  be 
j counter productive  both  w prohibit  fur- 
| ^,<?r  non  }1VA  technology  pursuits  and 
j to  remove  the  program  from  the  BCD 
j oversight  that  has  made  it  the  success 
l that  the  committee  commends/’  stated 
] Cohen  and  Shelton 
I The  CIA  dedi ned  to  comme nt  on  the 

I proposed  legislation.  * 

'The  baste  question  \ $t  will  there  be  $ I 

strong  director  of  centrsl  intelligence 
who  fa  in  charge  of  the  whole  communi- 
ty? The  Defense  Department  says  no,° 
Furthermore,  "because  of  the  ongoing 
militarisation  of  Intelligence,  my  bet  is  that  : 
the  Pentagon  wlii  get  its  way,"  he  said.  j 

Robert  Steele,  a 2 5 -year  veteran  of  the  j 

intelligence  community  and  author  of  the 
recent  book  “On  intelligence;  spies  and 
Secrecy  fn  an  Open  World,"  said  the  Infor- 
mation Age  has  challenged  t he  whole  no- 
tion of  having  a cent  ral  agency  responsible 
for  intelligence.  "In  the  age  of  distributed 
information,  the  concept  of  central  Intelli- 
gence 1$  an  oxymoron,"  Steele  said, 

- Dan  Verier* 

...  — 
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FBI  e-mail  Snooping  Device  Attacked 

By  £>  IAN  HOPPER,  Associated  Press  Wr  iter 

WASHINGTON  (AP)  - Civil  liberties  and  privacy  groups  railed 
Tuesday  against  a new  system  designed  to  allow  law  enforcement  asents 
to  intercept  and  analyze  huge  amounts  of  e-mail  in  connection  with  an 
investigation. 
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SwthfpBIP^U  i„CS,V°re’”  WaS  f,rst  hinted  at  00  April  6 5n  testimony  to  a House  subcommittee. 
When  Carnivore  is  placed  at  an  Internet  Sendee  Provider,  it  scans  all  incoming  and  outcome  P f 

messages  associated  with  the  target  ofa  criminal  probe.  mcormn^  ana  outgoing  e-mails  t 

In  a letter  addressed  to  two  members  of  the  House  subcommittee  that  deals  with  Fourth  Amendment 

to  mer-f " ?}?! LibertiK  "**>  tta  .he  “S Lxte 

adSes  2 well « °f ? llS  $usU?mcrs  b>'  readinS  both  sender  and  recipient 

addresses,  as  well  as  subjvci  Hues  of  e-mails,  to  decide  whether  to  make  a copy  of  the  entire  message. , 

Further,  while  the  system  is  plugged  into  the  Internet  provider’s  systems,  it  is  controlled  soieiv  hv  tho 

* tr3dhi0na3  Wirm?’ the  ** is  nwimabed  by  the16 

Carnivore  is  roughly  equivalent  to  a wiretap  capable  of  accessing  the  contents  of  the  conversation*.  nf 

ilie  *■»«*  >ta  ti«  fbi  miv  comSSs 

..  y ( target,  lead  the  letter.  This  ’trust  us,  we  are  the  government’  approach  is  the  antithesis  o 
the  procedures  required  under  our  wiretapping  laws.”  H anmnesu,  o 

Barry  Steinhardt,  associate  director  oi  the  ACLU,  said  citizens  shouldn't  trust  that  such  a sweenino  dat 
tap  will  only  be  used  against  criminal  suspects.  And  even  then,  he  said  the  data  mined  bv  CaSv  Ire 
particularly  subject  lines,  is  already  intrusive.  b>  Canuvore’ 

"Law  enforcement  should  be  prohibited  from  installing  any  device  that  allows  them  to  intercom 
communications  from  persons  other  than  the  target,”  Steinhardt  said  in  an  interview^  " When  conductm 
these  kinds  of  investigations,  the  information  should  be  restricted  to  only  addressing  infonSuon'' 

SXTil’ifA  C“K  b Cma<ly'  R'Fla  ’ whD  «»  Constitution  subcommittee,  said 
mat  the  congressman  had  no  immediate  comment  on  the  letter 
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in  Si  SSrtSf he  Kfm  Com-Revere,  a lawyer  ai  the  Hogan  & Hartson  law  fir 

The^vSrt,?LliS,  • represented  an  internet  provider  that  refused  to  install  the  Carnivore  svste 

fromPc™stomere  uiSaom<  2,1 awkward  P0Slt.10ntf  Corn'Revere  said»  because  the  company  feared  sui 
iroxn  customers  unhappy  with  the  government  looking  in  to  all  the  e-mail. 

kT°Wi  mSu  d (b'I  ih^ovcmtnml)  that  Carnivore  would  enable  remote  access  to  the  ISP's 
network  and  would  he  under  the  exclusive  control  of  government  agents,"  Com-Revere  said. 


— ----- — - u<wu  wuu  uduie  in  pan  oecause  oi 

lines,  and  that  the  law  was  stretched  to  cover  the  Internet  as  well 


Com-Revere  would  not  reveal  the  name  of  his  client,  and  the  client  lost  the  case.  He  said  that  the  FBI 
has  been  using  Carnivore  since  early  this  year.  uut  me  t li  1 

Cem“  fW  DOT0CraCy  *"d  TectaoloB’-  «M  •!«<  the 

""'VOrk °f 2” K1V' Dcmpsey  said-  "N»«  «*» * 

But  Dempsey  said  that  Internet  providers  contributed  to  the  problem,  bv  savine  that  current  tecWo<r 
does  nm  allow  the  Internet  provider  to  sort  out  exactly  what  the  government  ^entitled  to  ce*  u'nd- ^ 
search  warrant  1 he  earners  complained  that  they  had*  to  give  everything  to  the  FBI.  “ fe 

The  sen-ice  providers  said  they  didn’t  know  how  to  comply  with  court  orders  " D'-mosev  s--*;4  ”pv 
takmg  that  position,  they  have  hurt  themselves,  putting  themselves  into  a box  " ‘ } 

buSu\5°S  Sr!? the  FBI  s Cybfr  'fcchnol°gy  Section,  told  the  Wall  Street  Journal  that  the 
bureau  has  about  ^0  Carnivore  systems,  which  are  PCs  with  proprietary  software.  He  said  C^rntvn^ 

meets  current  wiretapping  laws,  but  is  designed  to  keep  up  with  the  Internet, 

cSfvoreUSt  “ Spedalized  SiliiTer*” Thomas  io!d  «»  Journal,  which  first  reported  details  about 

feSfef  “ e'm,il  ”"*«  Pr°*r™  “*  P0P-  s,iil  sl3«  ”>  0»  Carnivore,  an 

Dempsey  has  a possible  solution  to  the  problem,  though  one  that's  probably  unlikely  - show  everyone 
what  it  does  and  how  it  does  it,  allowing  Internet  providers  to  install  the  software  themselvk  ' 

The  FBI  should  make  this  gizmo  an  open-source  product,"  he  said,  "Then  the  secret  is  gone.” 


On  the  Net:  Federal  Bureau  oflnvestigation:  http:tfvww.lbl.gov 
American  Civil  Liberties  Union:  http://mTO  .aclu.orp 
Center  for  Democracy  and  Technology:  http:tfwmv.cdt.org 
Pretty  Good  Privacy  (PGP):  wmv.pgp.com 
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Reno  to  review  the  FBI's  Internet  wiretap  system 

WASHINGTON,  July  13  (Reuters)  - US.  Attorney  General  Janet  Reno  said  on  Thursday  she 
would  review  a new  FBI  automated  computer  system  that  can  wiretap  the  Internet  to  determine 
whether  it  might  infringe  on  privacy  rights. 

"I'm  taking  a took  at  it  now  to  make  sure  that  we  balance  the  rights  of  all  Americans  with  the 
technology  of  today,’’  Reno  said  when  asked  about  the  FBI  system  known  as ' 'Carnivore"  that 
can  be  used  to  monitor  all  e-mails  of  a criminal  suspect. 

Reno  emphasised  that  any  such  wiretaps,  which  are  placed  on  an  Internet  sendee  provider's 
system,  cannot  be  be  done  without  an  appropriate  court  order  "according  to  processes  and 
procedures  used  now  for  lawful  surveillance.” 

"We  are  looking  at  it  to  see  what  is  needed,  if  anything,”  she  said.  "If  additional  regulations  are 
needed,  we  will  pursue  those,” 

She  fold  her  weekly  news  briefing  that  she  wanted  to  make  sure  that  the  new  technology  doss  not 
become  "a  cause  of  concern  for  privacy  interests." 


The  American  Civil  Liberties  Union  (ACLU)  and  other  privacy  advocates  have  expressed 
concern  the  new  system  could  scan  private  information  about  legal  activities,  resulting  in 
excessive  monitoring  of  online  communications.  Besides  e-mails,  she  system  can  monitor  visits 
to  Web  sites  and  Internet  chat  sessions. 


Reno  said  she  only  began  looking  into  the  issue  and  asking  questions  after  news  articles  appeared 
earlier  this  week.  The  FBI  recently  demonstrated  the  system  to  executives  in  the 
telecommunications  industry. 

"We  have  known  about  the  capacity  to  do  this.  Its  application  and  what  has  been  done  had  not 
been  brought  to  my  attention, ” Reno  said. 


The  FBI’s  director,  Louis  Freeh,  reports  to  Reno. 

"1  just  wunt  to  make  sure  that  industry,  privacy  interests,  law  enforcement  interests  are  all  fully 
advised  so  that  we  can  consider  anybody’s  concerns  and  make  sure  that  we  address  them,”  Reno 
said. 

She  was  unable,  to  say  whether  the  system  would  continue  to  operate  until  her  review  was 
underway. 

13:29  07-13-00 

Copyright  2000  Reuters  Limited.  All  rights  reserved. 
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Controls  on  Export  of  Encryption  Software  to  be 
Eased 


By  John  Schwartz 
Washington  Post  Staff  Writer 
Monday,  July  17,  2000;  1:12  PM 

The  Clinton  administration 
announced  today  that  it  will 
loosen  controls  on  the  export  of 
encryption  software  - the 
programs  that  help  users 
scramble  messages  and  data  to 
protect  it  from  prying  eyes  - and 
called  for  new  legislation  intended 
to  make  sense  of  wiretapping  in 
the  Internet  age. 


—live  Online— 

* David  Steer 

of  TRUSTe  discusses  how  to  protect 
sensitive  personal  information  at  1 1 
<:.m,  Wednesday. 

Protect  Your  Kids;  Amy  Aldmsn  of 
the  Center  for  Media  Education 
discusses  ways  to  protect  you 
children  online  at  1 p.m,  Thursday, 
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"We  need  to  seek  a better  balance  g-nasi  this  Article 

amongst  the  sometimes  Prmter-Fngnriiv  Version 

competing  goals  of  the  protection 

of  public  safety,  the  achievement  of  economic  growth  and  digital 
opportunity  - and  the  preservation  of  privacy  and  civil  liberties,"  said 
White  House  Chief  of  Staff  John  Podesta  in  a speech  delivered  today  at 
the  National  Press  Club. 

Under  the  new  policy,  American  companies  will  be  able  to  export  the 
strongest  cryptography  products  to  users  in  any  nation  in  the  European 
Union  and  to  Australia,  Norway,  the  Czech  Republic,  Hungary',  Poland, 
Japan,  New  Zealand  and  Switzerland.  The  government  will  eliminate  a 
current  statutory  30-day  waiting  period  before  such  exports  can  take 
place,  but  keeps  in  place  a requirement  that  new  technologies  be 
submitted  to  the  government  for  a technical  review. 

Encryption  has  been  a high-tech  battlefield  from  the  early  days  of  the 
Clinton  administration.  Few  technologies  are  as  important  in  the  fight  to 
maintain  persona!  and  business  privacy  - hut  few  technologies,  as  well, 
present  such  daunting  issues  for  law  enforcement,  which  warns  that 
criminals  and  terrorists  can  use  "crypto"  to  cloak  their  plans  and 
activities.  But  high-tech  companies  successfully  argued  that  U.S, 
restrictions  only  harmed  American  companies,  since  overseas  firms 
were  successfully  marketing  strong  encryption  products,  and  in  January 
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today's  speech,  Podesta  stressed  tire  now-familiar  theme  that  the  online 
revolution  has  been  a mixed  blessing.  At  the  same  time  that  the  Internet 
makes  Shakespearean  sonnets  and  new  photos  of  Mars  available 
anywhere  in  the  world,  it  has  undermined  the  pirvacy  of  our  most 
sensitive  financial  and  medical  records,  and  allows  such  evildoers  as 
international  drug  traffickers  to  communicate  freely  and  secretly. 

"That's  why  we  have  to  make  sure  the  Internet  is  used  to  the  benefit  of 
people  - not  to  their  detriment,"  the  Podesta  said. 


The  most  sweeping  part  of  the  Podesta  address  was  a call  for  a thorough 
rethinking  of  the  Fourth  Amendment's  protection  against  unreasonable 
search  and  seizure  in  the  Internet  age.  Electronic  mail  transmitted  by 
high-speed  connections  such  as  DSL  modems,  Podesta's  speech  argued, 
has  never  enjoyed  the  legal  protections  the  law  gives  to  telephone 
conversations  - or  to  slower  dial-up  modems  under  the  Electronic 
Privacy  Communications  Act  of  1984.  At  the  same  time,  cable  privacy 
laws  are  tougher  than  wiretap  standards  when  it  comes  to  gaining  access 
to  subscriber  records  ~ which  could  include  e-mail  sent  via  cable 
modem.  Podesta  called  for  new  legislation  to  address  the  inconsistencies 
in  the  legal  framework.  "It’s  time  to  adopt  legislative  protections  that 
map  these  important  privacy  principles  onto  the  latest  technology,"  he 
said. 

Podesta's  speech  also  make  oblique  reference  to  a controversial  new 
surveillance  technology  revealed  last  week,  which  is  known  as 
"Carnivore."  Carnivore  gives  government  the  ability  to  selectively 
monitor  Internet  traffic  of  individuals  in  ways  that  can  give  law- 
enforcement  the  Internet  equivalent  of  "trap  and  trace"  capabilities  used 
in  telephone  surveillance.  Unlike  full-fledged  wiretaps,  the  judicial 
oversight  of  trap  and  trace  is  slight,  and  the  protection  against  abuses  of 
the  technology  fay  law  enforcement  is  weak.  Podesta  called  for  "greater 
judicial  oversight  of  trap  and  trace  authorities." 

Podesta's  speech  stated  that  this  legislation  could  be  passed  by  the  end  of 
the  year  - an  unlikely  prospect  in  these  waning  days  of  the  legislative 
session.  "It's  time  to  update  and  harmonize  our  existing  laws  to  give  all 
forms  of  technology  the  same  l egislati  ve  protections  as  our  telephone 
conversations,”  he  said. 

The  speech  also  made  the  point  that  the  administration's  preference  is 
for  public-private  partnerships  to  make  the  Internet  secure  against 
attack,  hut  noted  that  Congress  has  not  appropriated  any  of  the  $90 
million  President  Clinton  has  requested  for  security  research  and  cyber 
policing.  "It’s  time,"  Podesta  noted,  that  "they  picked  up  the  pace  and 
provided  the  protections  that  are  essential  to  America’s  cyber  security.," 


The  speech  was  not  well  received  by  civil  liberties  advocates,  who  have 
fought  Carnivore  and  other  administration  attempts  to  develop 
wiretapping  capabilities  on  the  Internet,  Barry  Steinhardt,  associate 
director  of  the  American  Civil  Liberties  Union,  called  the  speech 
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"deeply  disappointing." 

Rather  than  defending  Carnivore,  Steinhardt  said,  Fodesta  should  have 
announced  that  the  administration  was  suspending  its  use.  "Carnivore 
represents  a grave  threat  to  the  pri  vacy  of  all  Americans  by  giving  law 
enforcement  agencies  unsupervised  access  to  s nearly  unlimited  amount 
of  communications  traffic,"  Steinhardt  said  in  a statement. 

’’While  tlie  Clinton  administration's  proposals  have  some  heartening 
qualities  to  them,  they  are  too  tittle  and  too  late,’’  with  too  little  time  in 
the  legislative  session  to  pass  new  bills.  "Last-minute  legislative 
proposals  cannot  satisfy'  the  deep  privacy  concerns  of  the  American 
public,"  Steinhardt  said. 

© 2000  The  Washington  Post  Company 
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Proposal  Offers  Surveillance  Rules  for  the 
Internet 

White  House  Tries  to  Balance  Rights  of  Computer  Users 
and  Law  Enforcement 

By  STEPHEN  LA  BATON  with  MATT  RJCHTEL 

WASHINGTON,  July  17  - The  White 
House  said  today  that  It  would  propose 
legislation  to  set  legal  requirements  for 
surveillance  in  cyberspace  by  law  enforcement 
authorities  similar  in  some  ways  to  those  for 
telephone  wiretaps. 

Privacy  advocates  and  civil  liberties  groups 
welcomed  some  aspects  of  the  proposal  hut 
said  they  remained  alarmed  about  a new  F.8.I. 
computer  system  that  searches  and  intercepts 
private  e-mail  and  can  easily  capture 
communications  of  people  not  suspected  of 
crimes. 

The  legislati  ve  proposal  was  made  as  the 
administration  also  announced  today  that  it  had 
eased  export  controls  on  encryption  technology, 
making  it  significantly  easier  for  American 
companies  to  sell  software  products  to  the 
European  Union  and  eight  other  trading 
partners  that  cart  be  used  to  keep  computer  data 
and  communications  secure. 

Both  the  electronic  surveillance  proposal  and 
the  export  control  changes  are  part  of  a broader 
policy  outlined  in  a speech  today  by  John  D. 

Podesta,  the  White  House  chief  of  staff.  He  said 
the  policy  tries  to  balance  the  privacy  rights  of 
computer  users  against  the  needs  of  law 
enforcement  to  be  able  to  monitor  digital 
communications. 
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■ House  Proposes  New  Standard  *V  Monitoring  the  Internet 


Congress  and  federal  regulators  have  done  little  work  in  the  area, 
even  as  the  world  has  quickly  come  to  rely  heavily  on 
communications  through  cyberspace-.  More  than  1 ,4  billion  e-mail 
messages  change  hands  every  day. 

The  administration's  legislative  proposal  on  electronic  surveillance 
tries  to  fix  the  inconsistent  patchwork  of  laws  that  apply  different 
standards  to  telephone,  cable  and  other  technologies  with  a single 
standard  for  those  systems  and  the  Internet.  Prospects  for  the 
proposal  in  Congress  are  uncertain. 

Until  now,  law  enforcement  agencies  have  been  able  to  monitor 
electronic  communication  with  only  modest  court  supervision. 

The  proposed  legislation  would  require  that  the  same  standards  that 
apply  to  the  interception  of  the  content  of  telephone  calls  apply  to 
the  interception  of  e-mail  messages.  Specifically,  it  would  require 
law  enforcement  agents  to  demonstrate  that  they  have  probable 
cause  of  a crime  to  obtain  a court  order  seeking  the  contents  of  a 
suspect's  e-mail  messages. 

The  proposal  would  also  give  federal  magistrates  greater  authority 
to  review  requests  by  law  enforcement  authorities  for  so-called  pen 
registers  — lists  of  the  phone  numbers  called  from  a particular 
location  and  the  time  of  the  calls.  The  magistrates  now  have  no 
authority  to  question  the  request  for  such  lists,  which  are  frequently 
used  by  the  authorities. 

In  the  context  of  the  Internet,  existing  laws  are  ambiguous  about 
what  standards  apply  for  different  kinds  of  surveillance.  Many 
limitations  imposed  on  law  enforcement  in  the  con  text  of  telephone 
wiretaps  — like  the  requirement  that  such  taps  be  approved  at  the 
highest  level  of  the  Justice  Department  — do  not  appear  to  apply  to 
e-mail  surveillance. 

Moreover,  the  Cable  Act  of  1984  sets  a far  harder  burden  for 
government  agents  to  satisfy  when  trying  to  monitor  computers 
using  cable  modems  than  when  monitoring  telephones.  That  has 
proved  troublesome  for  law  enforcement  authorities  as  more 
Americans  begin  to  use  high-speed  Internet  service  through  cable 
networks.  The  Cable  Ac  t also  requi  res  that  the  target  of  the 
surveillance  be  given  notice  and  an  opportunity  to  challenge  the 
request. 

"It’s  time  to  update  and  harmonize  our  existing  law's  to  give  all 
forms  of  technology  the  same  legislative  protections  as  our 
telephone  conversations,"  Mr.  Podesta  said  in  a speech  at  the 
National  Press  Club.  "Our  proposed  legislation  would  harmonize  tire 
legal  standards  that  apply  to  law  enforcement's  access  to  e-mails, 
telephone  calls  and  cable  services." 

White  House  officials  said  today  that  they  hoped  the  proposal  would 
break  a logjam  in  Congress  where  a variety  of  different  measures 
have  been  introduced  dealing  with  electronic  surveillance.  The 
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admi  nistration's  proposal  adopts  some  elemen  ts  of  both  Democratic 
and  Republican  bills. 

But  Congressional  aides  said  there  was  too  little  time  left  in  the 
legislative  session  and  that  the  matter  would  in  all  likelihood  remain 
f"  unresolved  until  after  the  next  term  begins,  in  2001 , 

_ t. 

Administration  officials  said  the  proposal  would  apply  to 
communications  that  either  begin  or  end  in  the  United  States.  It 
would  not  apply  to  e-mail  messages  transmitted  entirely  outside  the 
country. 

Privacy  and  civil  liberties  groups  criticized  the  administration's 
proposal  because  it  would  continue  to  permit  the  government  to  use 
a new  surveillance  system  that  the  groups  say  may  be  used  far  more 
broadly  than  older  technologies,  enabling  federal  agents  to  monitor 
an  unlimited  amount  of  innocent  communications,  including  those 
of  people  who  are  not  targets  of  criminal  investigations. 

The  system,  used  by  the  Federal  Bureau  of  Investigation,  is  called 
Carnivore,  so  named,  agents  sav,  because  it  is  able  to  quickly  get  the 
"meat”  in  huge  quantities  of  e-mail  messages,  so-called  instant 
messaging  and  other  communications  between  computers. 

Carnivore  is  housed  in  a small  black  box  and  consists  of  hardware 
and  software  that  trolls  for  information  after  being  connected  to  the 
network  of  an  Internet  service  provider.  Once  installed,  it  has  the 
ability  to  monitor  all  of  the  e-mail  on  a network,  from  the  list  of 
what  mail  is  sent  to  the  actual  content  of  the  communications. 

Marcus  C>  Thomas,  section  chie  f of  the  Cyber  Technology  Section 
of  the  F.BX,  said  the  technology  was  developed  5 8 months  ago  by 
F.B.l.  engineers  and  has  been  used  fewer  than  25  times.  Mr.  Thomas 
said  that  Carnivore  had  potentially  broad  capabilities  and  that  he 
understood  the  concerns  of  pri  vacy  groups. 

"It  can  do  a ton  of  things,"  he  said.  "That's  why  it's  illegal  to  do  so 
without  a clear  order  from  the  court." 

He  said  that  most  Internet  sendee  providers  had  cooperated  with 
requests  to  use  Carnivore. 

Privacy  groups  and  some  Internet  service  providers  have  been 
deeply  critical  of  the  use  of  Carnivore  because,  once  installed  on  a 
network,  it  permits  the  government  to  take  whatever  information  it 
wants. 

Moreover,  the  government  has  not  said  what  it  does  with  the 
extraneous  material  it  gathers  that  is  not  relevant  to  the  particular 
surveillance. 

The  issue  does  not  often  arise  today  with  the  monitoring  of 
telephone  conversations  because  when  a law  enforcement  authority 
wants  to  see  a list  of  telephone  calls  made  by  a suspect,  the  agent 
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gets  an  order  from  a magistrate,  presents  the  order  to  a telephone 
company,  and  the  company  then  turns  over  the  list. 

In  at  least  one  instance,  an  Internet  company  did  not  cooperate  so 
readily  with  the  government.  In  December,  federal  marshals 
approached  the  company  with  a court  order  permitting  them  to 
deploy  a device  to  register  time,  date  and  source  information 
involving  e-mail  messages  sent  to  and  from  a specified  account 


Trying  to  establish 
a single  standard 
for  different 


Concerned  the  device  would 
record  broader  information,  the 
company  countered  with  a 
compromise:  it  would  provide  the 
government  with  the  requested 


technologies. 


information  about  e-mail  senders 

and  recipients,  according  to  Robert 

Com-Revere,  a lawyer  for  the 
company,  in  recent  Congressional  testimony.  The  company  was 
later  identified  as  EarthUnk,  a service  provider  with  3.5  million 
subscribers. 


Mr.  Com-Revere  said  the  government  initially  accepted  the 
compromise  but  later  became  dissatisfied  and  wished  to  use  its  own 
device.  EarthLInk  objected  but  was  overruled  by  a a federal  court, 
which  ordered  the  device  deployed. 

Other  Internet  companies  have  also  been  critical  of  Carnivore. 

William  L,  Schrader,  chairman  and  chief  executive  of  PSINet,  a 
major  commercial  Internet  service  provider,  said  that  the  system 
gave  the  F.B.L  the  ability  to  monitor  e-mail  messages  of  every 
person  on  a given  network.  He  said  he  would  refuse  to  permit  the 
government  to  use  the  technology  at  PSINet  unless  agents  could 
prove  that  it  could  only  sift  out  the  traffic  from  a given  Individual 
that  is  the  target  of  a court  order. 

"I  object  to  American  citizens  and  any  citizens  of  the  world  always 
being  subject  to  someone  monitoring  their  e-mail,"  said  Mr, 
Schrader,  whose  company  serves  about  100,000  businesses  and 
more  than  10  million  users.  “I  believe  it's  unconstitutional  and  I’ll 
wait  for  the  Supreme  Court  to  force  me  to  do  it." 


Civil  liberties  groups,  meanwhile,  said  that  today's  policy 
announcement  was  an  inadequate  response  to  the  growing 
controversy  over  the  deployment  of  Carnivore. 

"Today's  speech  was  camouflage  to  cover  the  mess  that  is 
Carnivore,"  said  Barry  Steinhardt,  an  associate  director  of  the 
American  Ci  vil  Liberties  Union,  "in  light  of  the  public  and 
Congressional  criticism  of  Carnivore,  we  had  hoped  and  expected 
far  more  from  an  administration  that  likes  to  tout  its  sensitivity  to 
privacy  rights.  Rather  than  glossing  over  Carnivore,  Podesta  should 
have  announced  that  the  administration  was  suspending  its  use." 

Facing  growing  concerns  about 
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Facing  growing  concerns  about 
Carnivore,  Attorney  General  Janet 
Reno  said  on  Thursday  that  she 
would  review  whether  the  system 
was  being  used  in  a manner 
consistent  with  privacy  rights  in 
the  Constitution  and  in  federal 
law,  A subcommittee  of  the  House 
is  set  to  hold  a hearing  next  week  on  the  system. 


Concern  that  the 
proposals  allow 
federal  agents  too 
much  leeway. 
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While  the  civil  liberties  and  privacy  groups  applauded  giving  judges 
greater  discretion  to  review  certain  kinds  of  requests  tor 
surveillance,  they  were  critical  of  other  aspects  of  the  proposal. 

Mare  Rotenberg,  director  of  the  Electronic  Privacy  Information 
Center,  a research  organization  that  studies  privacy  issues  and 
technology,  criticized  the  administration  for  lowering  the  standards 
for  surveillance  of  cable  modems  rather  than  raising  the  st  andards 
for  telephone  surveillance. 


"The  Cable  Act  provides  for  one  of  the  best  pri  vacy  protections  in 
the  United  States,"  Mr.  Rotenberg  said.  ’’The  question  is  whether  to 
harmonize  up  or  harmonize  down.  Our  view  is  this  harmonizes 
down.” 

Rut  administration  officials  said  tits  Cable  Act  never  contemplated 
that  there  would  be  broad  use  of  cable  modems  for  e-mail  traffic  and 
that  the  standards  used  for  obtaining  warrants  for  telephone 
surveillance  should  also  apply  to  digital  communications  through 
cable  networks. 
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The  FBI  is  in  a full-court  press  to  reassure  the  public  about  its  Carnivore  intercept  system,  designed  to 
perform  a "wire-tapping"  function  on  the  Internet. 

During  a background  briefing  for  reporters  Friday,  FBI  officials  said  die  system  can  only  be  used  under 
court  order,  and  that  "procedure,  training  and  audits"  of  its  use  will  prevent  technicians  from  attempting 
unauthorized  snooping. 

A senior  official  added  that  the  bureau  is  looking  for  "a  couple  of  technical  institutions"  outside  the  FBI 
to  independently  "validate  and  evaluate"  the  system's  operation  and  integrity. 

The  system  has  drawn  fire  from  an  unlikely  coalit  ion  of  critics. 

The  American  Civil  Liberties  Union  and  similar  groups  have  attacked  Carnivore  as  new  government 
intrusion  without  proper  safeguards.  The  Republican  leadership  of  Congress  has  also  been  highly  critical, 
and  a House  Judiciary  subcommittee  has  planned  hearings  Monday  to  explore  what  some  politicians 
believe  is  a need  for  new  federal  restrictions  on  its  use. 

Meanwhile,  the  average  computer  user  may  feel  that  Big  Brother  is  looking  over  his  or  her  shoulder. 
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Not  so,  says  the  FBI  in  its  most  soothing  official  voice. 


At  Friday’s  briefing  in  a conference  room  at  bureau  headquarters  in  Washington,  the  senior  FBI  official 
said  the  Carnivore  program  is  three  years  old,  and,  "ft  began  because  we  were  receiving  court  orders  to 
do  intercepts  on  the  Internet." 

Carnivore  software  - so  named  because  it  looks  for  the  "meat”  in  a data  stream  - uses  a Windows 
platform  and  is  contained  on  a personal  computer  that  is  plugged  into  an  Internet  service  provider.  The 
access  is  allowed  only  for  the  length  of  time  set  out  in  a court  order.  "When  the  order  expires,  we  take  our 
equipment  away,"  the  senior  official  said. 

the  ISP  usually  performs  some  "pre-filtering"  of  data  so  that  the  amount  of  information  traveling  through 
the  Carnivore  "filter”  is  not  overwhelming.  The  Carnivore  device  can  perform  a traditional  "pen 
register”  function  on  the  Internet  - record  and  store  the  origin  and  destination  of  e-mail  - or  capture  the 
content  of  an  e-mail  message,  much  like  a traditional  phone  tap,  only  in  a much  more  specific  way. 

"That  filter  is  configured  to  fit  the  contour  of  the  court  order  we're  assigned  to  do,”  the  senior  official  said. 
In  other  words,  it  will  only  select  and  copy  specific  information  authorized  fay  a federal  judge.  Die  system 
targets  e-mail  by  an  "authorization"  code  peculiar  to  an  individual  user,  and  die  FBI  will  not  monitor 
subject  lines  on  e-mail.  , 


The  filtering  process  will  not  slow  down  computer  response  time,  another  FBI  official  familiar  with  the 
technology  said.  "It’s  just  passively  watching  the  bits."  Release  a 
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Hie  approval  process  for  a Carnivore  intercept  is  also  extremely  rigorous,  an  FBI  official  expert  in  cyber 
legal  issues  said.  Investigators  seeking  a court  order  to  use  Carnivore  must  go  through  an  internal  FBI 
review  process,  then  the  request  must  be  approved  by  the  attorney  general  or  the  deputy  attorney  general 
before  a federal  judge  is  approached  for  a court  order. 

Less  than  a dozen  such  requests  have  been  made  over  the  last  year  for  criminal  probes  - as  opposed  to 
national  security  investigations  - and  no  request  has  been  refused  by  a judge. 

"These  (intercepts)  are  not  implemented  trivially,"  the  FBI  legal  official  said,  both  because  of  the  expense 
and  the  depth  o f review. 

What  about  someone  outside  the  FBI  hacking  into  the  Carnivore  device  and  accessing  an  innocent 
person's  e-mail? 

"The  device  cannot  be  penetrated  from  the  Internet  side,"  the  FBI  technical  official  said,  "Theoretically," 
a hacker  could  beat  very  high  odds  and  randomly  dial  into  a separate  monitoring  line,  he  added,  but  even 
that  line  is  protected  by  heavy  security. 

The  senior  official  at  Friday’s  briefmg  conceded  that  the  name  of  the  sy  stem  - Carnivore  - has  caused 
some  apprehension.  “Naming  is  always  a very  sensitive  thing,"  the  official  said,  “This  experience  is 
sobering.”  The  official  said  the  FBI  would  gi  ve  some  thought  in  the  future  to  the  effect  the  name  of  an 
operation  or  procedure  might  have  on  the  public. 

"Sniffer"  might  be  a fairer  term.  "It’s  a customized  packet  sniffer,"  the  FBI  technical  official  said. 

”A  very  well-focused  sniffer,"  the  senior  official  added. 
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NewsMax.com 


Controversy 

Boortz  on  Boortz 


The  Feds  Can  Read  Your  E-Mail 


NswsMax.com 
Wednesday,  July  12,  2000 

First  it  was  Echelon,  the  global  eavesdropping  system  Uncle  Sam  and  John  Bull 
have  been  using  to  spy  on  satellite-transmitted  phone  calls,  e-mails  and  fax 
messages.  Now  it's  Carnivore,  the  FBI’s  newest  electronic  snooping  device  that 
can  read  your  e-mail  right  off  your  mail  server. 

Capable  of  scanning  millions  of  e-mails  a second,  Carnivore  can  easily  be  used 
to  monitor  everybody’s  e-mail  messages  and  transactions,  including  banking 
and  Internet  commerce.  If  they  want  to,  the  feds  can  find  out  what  books  you’re 
buying  online,  what  kind  of  banking  transactions  you  conduct  — in  short, 
everything  you  do  when  you  go  online  and  send  e-mail,  whether  private  or 
commercial 


The  FBI  has  been  quietfy  monitoring  e-mail  for  about  a year.  Two  weeks  ago 
the  feds  went  public  and  explained  the  high-tech  snooping  operation  to  what  the 
Wall  Street  Journal  called  "a  roomful  of  astonished  industry  specialists." 

According  to  the  bureau,  they've  used  Carnivore  - so  called  because  it  can 
digest  the  "meat"  of  the  information  they're  looking  for  - in  less  than  100  cases, 
in  most  cases  to  locate  hackers  but  also  to  track  terrorist  and  narcotics 
activities. 


But  there  is  nothing  to  stop  Carnivore  from  making  a meal  of  your  e-mail 
messages  and  transactions  if  they  decide  that’s  what  they  want  to  do  and  can 
get  a judge  to  issue  a court  order  allowing  them  to  tap  your  e-mail  as  they  would 
your  phones. 


That's  scant  comfort  considering  the  underhanded  means  the  feds  employed  to 
get  court  orders  to  raid  the  Branch  Davidian  compound,  or  to  win  a judge’s 
permission  to  stage  what  amounted  to  an  illegal  armed  raid  on  Elian  Gonzalez's 
Miami  home. 

Carnivore  is  nothing  but  a store-bought  personal  computer  with  special  software 
that  the  FBI  Installs  in  the  offices  of  Internet  service  providers  (ISPs). 


The  computer  is  kept  in  a locked  cage  for  about  a month  and  a half.  Every  day 
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an  agent  comes  by  and  retrieves  the  previous  day’s  e-mail  sent  to  or  by 
someone  suspected  of  a crime. 

But  critics  say  that  Carnivore,  like  some  ravening  beast,  is  simply  too  hungry  to 
be  trusted  - that  it  gives  the  feds  far  too  much  access  to  too  much  private 
information. 

"This  is  more  of  a vacuum  cleaner-type  approach  - it  apparently  rifles  through 
everything,"  David  Sobei,  general  counsel  for  the  Electronic  Privacy  information 
Center,  told  Fox  News. 

“It's  potentially  much  more  invasive  than  telephone  surveillance,” 

Carnivore  could  conceivably  monitor  afi  the  e-mail  that  moves  through  an  ISP  ~ 
not  merely  messages  sent  to  or  from  the  subject  allegedly  being  monitored. 
Critics  compare  it  to  eavesdropping  on  all  the  phones  in  a neighborhood  simply 
to  zero  in  on  just  one  phone. 

Disturbingly,  the  FBI  has  prevailed  in  challenges  against  forcing  ISPs  to  allow 
Carnivore  to  be  installed  in  their  offices.  According  to  the  Wail  Street  Journal, 
one  unidentified  iSP  put  up  a legal  fight  against  Carnivore  early  this  year  and 
lost. 

The  FBI  defends  Carnivore,  insisting  it  is  used  selectively  and  monitors  only  the 
e-mail  of  the  subject.  They  say  that  messages  belonging  to  those  not  being 
probed,  even  if  criminal,  would  not  be  admissible  in  court. 

"The  volume  of  e-mail  in  a location  is  generally  fairly  small  and  being  managed 
by  a small  number  of  e-mail  servers  on  a fairly  low-speed  network,"  said  Marcus 
Thomas,  chief  of  the  FBI’s  cyber  technology  section. 

"The  system  is  not  unlike  'sniffers’  used  within  the  networks  every  day.” 

That  fails  to  satisfy  critics  such  as  Sobei.  He  says  Carnivore  is  similar  to 
Russia's  surveillance  system,  called  “SORM,"  which  all  Russian  ISPs  are  forced 
to  install  to  allow  the  government  to  spy  on  whomever  it  chooses. 

It's  also  similar,  he  says,  to  the  notorious  Echelon,  the  National  Security 
Agency's  global  eavesdropping  system,  which  intercepts  telecommunications 
transmissions  from  around  the  world  and  looks  for  keywords  that  could  indicate 
illegal  activity. 

"Carnivore  is  really  the  latest  indication  of  a very  aggressive  stance  that  the 
bureau  is  taking  in  collecting  as  much  information  as  technically  possible," 

Sobei  said. 


FBI  spokesman  Paul  Bresson  insists  that  law-abiding  citizens  have  nothing  to 
fear  from  Carnivore.  "Anytime  we  develop  a system,  we’re  basically  balancing 
the  interests  of  national  security  against  that  of  the  privacy  of  the  public,"  he 
said. 


"This  issue’s  always  going  to  come  up.  We're  always  going  to  get  questions  We 
understand  that.” 
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Electronic  Surveillance 


Existing  laws  Permit  Collection 
Of  Information  From  E-Mail,  FBI  Says 

The  Federal  Bureau  of  Investigation  takes  the  posi- 
tion that  current  federal  law  gives  it  the  authority 
to  implement  the  use  of  special  software  and  hard- 
ware called  “Carnivore"  to  collect  information  from  the 
e-mail  messages  traveling  through  an  Internet  service 
provider's  e-mail  server,  according  to  testimony  by  FBI 
and  Justice  Department  officials  July  24  at  a congres- 
sional hearing.  The  hearing  before  the  House  Judiciary 
Committee's  Subcommittee  on  the  Constitution  was  j 
convened  in  response  to  an  uproar  triggered  by  a July 
1 1 article  in  the  Wolf  Street  Journal  disclosing  the  ex- 
istence of  Carnivore, 

According  to  the  officials’  testimony,  if  an  Internet 
service  prorider  is  financially  or  technologically  unable 
or  unwilling  to  provide  information  on  e-mails  pursuant  j 
to  a court  order,  the  FBI  will  hook  a Carnivore  unit  up 
to  the  ISP’s  server.  Carnivore  scans  what  officials  refer 
to  as  "the  smallest  subset"  of  information  from  in  com-  j 
ing  and  outgoing  e-mail  messages.  Carnivore  then  du- 
plicates the  information  and  lets  the  transmission 
stream  continue  to  flow. 

Carnivore  roads  the  incoming  information  and  filters 
ft  according  to  protocols  based  on  the  original  court  or- 
der. Usually,  the  order  will  authorize  the  FBI  to  collect  j 
the  “to”  and  ‘"from"  information  from  messages  going  l 
io  and  from  a particular  e-mail  address.  Only  the  rel*  ! 
evant  information  will  be  recorded.  All  extraneous  in-  j 
formation  will  remain  only  temporarily  in  the  random 
access  memory*  and  will  not  be  fixed  in  a stable,  re- 
corded format 

The  result,  according  to  the  PEL  will  be  a list  of 
e-mail  messages  that  have  been  sent  from  or  received 
by  a particular  e-mail  address  along  with  the  “to”  and 
“from”  information.  The  FBI  likens  this  to  the  results 
obtained  by  a combination  of.  telephone  trap-and-trace 
and  pen  register  devices,  which  produce  a list  of  tele- 
phone calls  to  and  from  a particular  number  giving  only 
the  calling  number  or  the  number  called,  " 

The  FBI  has  implemented  Carnivore  IS  times  since 
January  and  about  25  times  overall  since  it  was  put  into 
operation  two  years  ago,  according  to  Donald  M Kerr, 
assistant  director  of  the  FBI. 

Current  law  Authorizes  Carnivore*  Kerin  V,  di  Gregory, 
deputy  assistant  attorney  general  for  the  criminal  dm- 
sion,  testified  that  the  FBI  is  authorized  to  implement 
Carnivore  by  the  current  pen  register  and  trap-and- 
trace  law,  18  USC  3 121  et  seq.,  and  wiretap  law,  IB  USC 
2510-22* 

The  pen  register  law  allo  ws  an  FBI  investigator  to  ap- 
ply  for  an  ex  parte  order  from  a court  by  submitting  an 
affidavit  affirming  a certification  by  the  applicant  that  j 
’the  information  likely  to  be  obtained  is  relevant  to  an 


ongoing  criminal  Investigation*”  The  investigator  need 
not  make  a showing  of  probable  cause,  and  the  court 
does  not  have  the  discretion  to  refuse  to  Issue  the  order. 

By  following  this  procedure,  the  FBI  may  also  obtain 
from  an  ISP  the  “to"  and  “from"  information  from  in- 
coming and  outgoing  e-mail  messages  for  a particular 
address. 

Rep.  Jerrold  Nadier  (D-MY.)  expressed  concern  that 
a subject  of  such  scrutiny  might  never  come  to  know 
that  his  privacy  had  been  invaded  in  such  a manner,  be- 
cause the  pen  register  law  does  not  require  disclosure  if 
no  charges  are  ever  brought. 

Di  Gregory*  disputed  that  any  invasion  of  privacy 
would  have  taken  place  in  such  a situation.  He  said  that 
UvS.  Supreme  Court  precedents  establishing  that  a tele- 
phone user  has  no  legitimate  expectation  of  privacy  in 
the  numbers  he  dials  supports  the  view*  thai  an  e-mail 
user  has  no  such  expectation  of  privacy  in  the  ad-; 
dresses  on  incoming  and  outgoing  e-mail  communica- 
tions. 

According  to  di  Gregory*,  the  FBI  may  gain  access  to 
the  content  of  e-mail  messages  under  the  wiretap  law’ 
The  wiretap  lav/  requires  a high-ranking  officer  of  the 
Justice  Department  to  authorize  an  application  for  a 
court  order.  The  court  may  then  issue  an  order  autho- 
rising  the  government  to  listen  in  on  a telephone  con- 
versation  if  it  finds  that  there  is  probable  cause  to  be- 
lieve  that  someone  is  committing,  has  committed,  or  is 
about  to  commit  one  of  the  offenses  listed  in  18  USC 
2516,  that  there  is  probable  cause  to  believe  that  a wire- 
tap will  intercept  communications  concerning  that  of-  ; 
fense,  that  normal  investigative  procedures  have  failed 
or  appear  to  be  unlikely  to  succeed  or  are  too  danger- 
otis,  and  that  there  is  probable  cause  to  believe  that  the 
line  to  be  tapped  is  the  line  that  is  likely  to  be  used  for 
such  a communications. 

According  to  Kerr  and  di  Oregon*,  implementing 
Carnivore  under  these  statutes  will  result  in  minimized  I 
and  particularized  information  gathering,  and  does  not 
amount  to  a search  of  all  incoming  and  outgoing  e-mail  ; 
messages  traveling  through  an  ISP’s  server.  Addition- 
ally, in-house,  technological,  judicial,  and  adversarial 
oversight  will  ensure  that  these  methods  are  not 
abused. 

Croups  Dispute  Claim  of  Authority  This  assertion  was 
flatly  contradicted  by  Barry*  Stemhardt  of  the  American 
Civil  liberties  Union,  who  said  that  such  filtering  nee-  j 
essarily  involves  the  inspection  of  every  single  e-mail 
message  traveling  through  a server.  Such  broad  author*  ; 
ity  to  filter  through  private  communications  was  never 
contemplated  by  Congress  when  passing  the  pen  regis- 
ter end  wiretap  laws,  Steinhardt  said.  Furthermore,  he  I 
said,  no  matter  what  promises  the  administration  : 
makes  regarding  limiting  its  data  gathering  powers,  re- 
cent history  should  warn  Congress  not  to  believe  those 
promises, 

Steinhardt  offered  as  an  example  the  passage  of  the 
Communications  Assistance  to  Law  Enforcement  Act  of 
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19^4, 4?  SC  1001  et  seq.,  which  resulted  from  a comprO' 
mlse  with  law  enforcement  agencies  afraid  that  new 
technology  would  hamper  surveillance  of  telephone 
calls.  He  said  that  in  exchange  for  requiring  new  digital 
telephone  networks  to  be  constructed  to  preserve  exist- 
ing surveillance  capabilities,  the  FBI  agreed  not  to  use 
the  statute  to  fry  to  require  telephone  service  providers 
to  create  new  surveillance  capabilities.  Nevertheless, 
according  to  Stelnhardfs  testimony,  the  FBI  has  "con- 
sistently sought  greater  capacity  and  new  surveillance 
features  that  did  not  exist  in  1994,  In  some  cases,  they 
have  sought  capabilities  that  they  specifically  promised 
the  Congress  they  would  not  seek*1 

Filtering  out  “to”  and  “from*  information  is  not  as 
easy  as  the  FBI  makes  it  sound,  according  to  Alan  Dav- 
idson of  the  Center  for  Democracy  and  Technology, 
Davidson  presented  the  subcommittee  with  examples  of 
the  type  of  data  packets  that  are  collected  by  Carnivore, 
In  many  cases,  he  said,  the  "to"  and  "from"  informa- 
tion that  the  FBI  is  seeking  cannot  be  obtained  without 
looking  in  the  body  of  the  message. 

Both  Steinhardt  and  Davidson,  as  well  as  Peter  Wil- 
liam Sachs,  president  of  New  Haven,  Conn.,  ISP 
ICONN  LLC,  testified  that  the  type  of  information  that 
the  FBI  says  it  wants  from  Carnivore  can  be  easily  gath- 
ered by  the  ISPs  themselves  and  turned  over  to  law  en- 
forcement agencies  who  have  obtained  appropriate 
court  orders. 

Both  Sides  Living  in  the  Past  Both  law  enforcement 
and  civil  liberties  groups  are  still  thinking  m terms  of 
the  traditional  switched  telephone  network,  according 
to  Stewart  Baker;  a technology'  expert  with  the  Wash- 
ington Jaw  firm  of  Steptoe  & Johnson,  and  former  gen- 
eral counsel  to  the  National  Security  Agency. 

Baker  said  that  it  is  unrealistic  to  expect  ISPs,  par- 
ticularly small  ones,  to  be  capable  of  complying  with 
such  an  order  on  its  own.  "The  FBI  has  got  it  right,"  he 
said.  Without  Carnivore  or  some  similar  program,  ISPs 
would  be  faced  with  "an  extensive  unfunded  mandate" 
to  collect  Information  pursuant  to  court  orders. 

On  the  other  hand,  for  the  government  "to  say  you 
don't  have  an  expectation  of  privacy  in  information 
held  by  a third  party  is  just  crazy,”  Baker  said.  "Our  en- 
tire lives  are  In  the  hands  of  third  parties.” 

Some  kind  of  technological  solution  is  necessary  for 
law  enforcement  to  keep  up  with  techno-savvy  crimb 
nais,  he  said.  At  the  same  time,  innocent  people  must  be 
given  protections.  Whatever  the  Congress  does  decide 
to  do,  it  must  decide  quickly,  Baker  said,  or  legislation 
will  have  been  mooted  by  technological  developments. 

Hew  Legislation  on  Horizon*  The  subcommittee's  hear- 
ing came  a week  after  a White  House  official  outlined 
plans  by  the  Clinton  administration  to  introduce  a bill 
that  would  update  both  privacy  laws  and  provisions  I 
through  which  wiretapping  in  all  its  forms  is  utilized. 
The  bilk  which  the  White  House  has  yet  to  send  to  Con- 
grass,,  would  regulate  under  what  circumstances  law 
enforcement  could  view,  listen  to  and  trace  e-mails,  cel- 
lular phone  calls,  and  transmissions  over  cable  net- 
works. 

Speaking  at  the  National  Press  Club  July  18,  White 
House  Chief  of  Staff  John  Fodesta  said  the  bill  "would 
amend  statutes  using  outmoded  language  and  that  are 
hardware-specific  so  that  they  are  technologically  neu- 


tral, In  other  words,  the  legislation  would  apply  equal 
standards  to  both  hardware  and  software  surveillance” 

The  White  House  Is  characterizing  the  proposal  as 
one  that  would  increase  privacy  protections  by  requir- 
ing that  court  orders  authorizing  the  interception  of 
e-mail  be  preapproved  fey  high  level  Justice  Department 
officials.  Additionally,  the  proposal  would  also  make  it 
easier  to  Identify  someone  who  is  calling  or  using  elec- 
tronic means  to  contact  an  Individual  by  requiring  only 
one  "trap  and  trace”  order  to  trace  a call  or  Internet 
session  back  to  the  source.  Currently,  law  requires  an 
order  to  be  Issued  for  each  separate  trace  of  an  e-mail, 
which  are  usually  bounced  around  by  a number  of  dif- 
ferent Internet  services  during  a transmission,  thus  re- 
quiring multiple  orders  to  trace  a single  e-mail  Any 
such  orders  must  be  Issued  by  a judge  after  a factual 
finding  that  the  standard  for  criminal  activity  was  met. 

The  bill  also  allows  for  tracing  to  fee  conducted  with- 
out prior  court  approval  in  the  case  of  m "emergency," 
such  as  actions  that  threaten  national  defense,  or  large- 


sion  would  grant  authorities  the  same  access  to  the  In- 
ternet traffic  of  consumers  using  cable  modems  as 
those  who  use  dial-up  modems. 

"With  our  proposal,  we  would  retain  the  underlying 
purpose  of  the  Cable  Act  to  keep  confidential  the  list  of 
shows  that  customer  has  watched,”  Fodesta  said,  "but 
when  cable  systems  are  used  to  access  the  Internet 
through  cable  modems,  we  believe  the  rules  should  be 
the  tough  but  sensible  standards  we  also  support  for 
e-mails  and  telephone  calls.” 

Though  the  White  House  has  no  target  date  for  send- 
ing up  the  legislation,  the  administration  is  confident 
they  will  be  able  to  work  with  Congress  to  pass  the  leg- 
islation. "We/ve  been  able  to  strike  the  middle  ground, 
which  will  enable  us  to  get  there  fairly  quickly/'  White 
House  Spokesman  Jake  Siewert  told  BN  A, 

Records 

DOJ  Agrees  to  Release  of  Documents 
Underlying  Report  on  FBI  Crime  Laboratory 

Over  53,000  pages  of  background  information  per- 
taining to  the  Justice  Department  inspector  gener- 
al's investigation  of  the  Federal  Bureau  of  Investi- 
gation's crime  laboratory  are  subject  to  disclosure  as  a 
result  of  the  recent  settlement  of  a Freedom  of  Informa- 
tion Act  suit,  the  National  Association  of  Criminal  De- 
fense Lawyers  announced  Juiy  7.  NACDL  and  its  then- 
press  officer,  Jack  King,  were  the  original  plaintiffs  in 
the  suit  and  were  later  joined  by  Dr.  Frederic  White- 
hurst,  a former  employee  of  the  lab  whose  allegations 
prompted  the  investigation. 

Besides  allowing  the  plaintiffs  to  disclose  the  docu- 
ments, the  settlement  calls  for  the  Justice  Department 
to  pay  $355,000  in  attorney's  fees  and  to  post  a pointer 
on  its  website  referring  inquiries  about  the  documents 
to  NACDL’s  and  Whitehurst's  websites, 

NACDL  spokesman  Todd  Wells  said  the  organiza- 
tion would  make  the  materials  available  on  compact 
disc  for  a cost  of  $40.  Orders  can  be  placed  by  calling 
(202)  872-8600. 
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HEADLINE:  FBI  Defends  * Carnivore ’ E-Mail  Wiretap  on  Capitol  Hill 

BYLINE:  Kyra  Phillips,  Pierre  Thomas 

HIGHLIGHT:  FBI  officials  are  on  Capitol  Hill  today  defending  their  new  wiretap 
for  the  information  age.  It's  celled  Carnivore  and  it's  desicmed  to 


selectively  monitor  computer  e-mail  to  and  from  a suspe 


can  omy  oe  used 


with  a court  order.  Still,  critics  are  concerned  about  possible  privacy 


violations , 


THIS  IS  A 
■£  UPDATED. 


3PY  MAY  NOT  BE  IN  ITS  FINAL  FORK  AND 


KYRA  PH ILL 


LLIFS,  CNN  ANCHOR : FBI  officials  are  on  Capitol  Hill  today 
heir  new  wiretap  for  the  information  aoe. 


It's  called  Carnivore  and  it's  designed  to  selectively  monitor  computer  e* 
mail  to  and  from  a suspect.  It  can  only  be  used  with  a court  order,  still, 
critics  are  concerned  about  possible  privacy  violations. 


More  now  on  the  controversy. 


fere’s  Just 


re  co r re  sponoen 


Hi,  Pierre, 

PIERRE  THOMAS,  CNN  JUSTICE  CORRESPONDENT : Hi,  Kyra,  As  you  pointed  out, 
the  FBI  says  Carnivore  is  a new  investigative  tool  which  can  tap  into  the  e~ 
mail  of  a suspect,  but  only  with  a court  order.  But  critics  say  it’s  Big 
Brother  on  the  Internet,  And  today,  Congress  wanted  answers. 

(BEGIN  VIDEO  CLIP) 

UNIDENTIFIED  MALE:  Even  a system  designed  with  the  best,  of  intentions  to 
legally  carry  out  essential  law  enforcement  functions  may  be  a cause  for 
concern  if  it’s  use  is  not  properly  monitored. 

REP.  JOHN  CONYERS  (D) , MICHIGAN:  Constitutional  rights  don’t  end  where 
cyberspace  begins . 

(END  VIDEO  CLIP) 

THOMAS:  But  the  FBI  was  quick  to  point  out  the  restrictions  that  govern 
Carnivore.  The  FBI’s  top  lab  official  explained  the  safeguards, 

(BEGIN  VIDEO  CLIP) 

UNIDENTIFIED  KALE:  In  every  case  we  require  a court  order.  That  court 
order  is  specific  to  the  numbers  we  target,  if  you  will,  the  addresses  we  can 
target , 
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{END  VIDEO  CLIP) 


THOMAS : Today  was  a fact-finding  hearing  and  there  was  one  point  of  early 
agreement:  Carnivore  may  not  be  the  best  name  for  this  system  — Kyra, 

PHILLIPS:  All  right,  Pierre  Thomas,  thanks  so  much. 

TO  ORDER  A VIDEO  OF  THIS  TRANSCRIPT,  PLEASE  CALL  8G0-CNN-NE&S  OR  USE  OUR 
SECURE  ONLINE  ORDER  FORM  LOCATED  AT  www.fdch.com 
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BODY : 

Who's  Afraid  Of  The  Big,  Bad  Carnivore? 

This  week,  it  finally  happened:  the  government  made  clear  Its  intent  to 
expand  wiretapping  from  switched  voice  traffic  to  Internet  traffic*  The 
implications  for  Xnterriet-service  providers  and  cable  operators  are  enormous  * 

Last  Monday,  White  House  Chief  of  Staff  John  Podesta  proposed  a bill  to 
{in  my  assessment)  expand  the  voice  wiretapping  allowed  under  the 
Communi ca t ions 

Assistance  for  Lav;  Enforcement  Act  to  e-mail,  Podesta  defended  the  FBI’s 
"Carnivore * packet-sniffing  software,  which  allows  the  government  to  read  the 
address  information  and  content  of  e-mail. 

My  coverage  of  the  proposal  (C?  7/18)  was  quite  restrained,  as  I wanted 
to  give  it  fair  scrutiny  before  judging  it, 

I've  given  the  plan  that  scrutiny,  and  1 think  it  Vs  a had  one.  Here 

are 

two  reasons  why: 

1}  The  administration  avoided  honest  debate  on  the  rationale  for  spying 
on  citizens*  Podesta , in  particular,  misrepresented  the  uses  of  wiretaps.  He 
also  was  misleading  in  saying  there  had  been  no  improper  voice  wiretaps,  a 
* fact w he  used  to  support  IP  wiretapping, 

FBI  and  Justice  Department  officials,  in  testimony  to  Congress, 
inevitably  tout  wiretapping  as  a solution  to  terrorism  and  child  pornography  - 

political  hot-button  crimes  everyone  opposes*  That  testimony  draws  favorable 
press  coverage  and  congressional  support.  Who  wants  to  be  portrayed  as 
supporting  those  crimes? 

Podesta  hit  the  same  theme  in  describing  Title  III  of  the  1968  Crime 
Control  and  Safe  Streets  Act,  which  set  the  rules  for  voice  wiretapping.  The 
administration  wants  to  apply  Title  III -type  rules  to  Internet  spying, 

"It  only 

allowed  wiretaps  in  the  most  serious  crimes,  such  as  espionage,  treason  and 
crimes  of  violence, " Podesta  said* 

But  those  are  rarely  the  crimes  against  which  law  enforcement  uses 
wiretaps*  The  1999  wiretapping  report  by  the  Administrative  Office  of  the 
United  States  Courts  (available  on  the  Web  site  of  the  Electronic  Privacy 
Information  Center)  shows  there  were  1,350  Title  III  wiretaps  last  year. 

There 

were  only  174  in  1968* 

The  report  includes  a breakdown  of  the  crimes  that  were  the  basis  for 
each  wiretap*  A full  978  of  the  wiretaps  in  1999  were  drug  cases*  Agencies 
rarely  mention  that  fact  when  seek  wiretapping  authority*  because  they  know  it 
weakens  their  argument*  Tap  cur  phones  because  terrorists  might  blow  someone 
up?  Maybe  so*  Tap  them  because  someone,  somewhere,  is  smoking  a joint?  I 
don ' t know , 

Drug  cases  were  followed  by  racketeering  (139  cases)  * Only  when  we 
get  to  homicides /assaults  (62  cases)  do  we  hit  the  * crimes  of  violence1-  cited 
by  Podesta.  National -security  wiretaps  do  not  even  come  under  Title  III,  but 
the  Foreign  Intelligence  Surveillance  Act.  There  were  886  wiretaps  under  FISA 
in  1999*  No  breakdown  of  those  cases  is  available,  so  we  can f t tell  if  they 
were  indeed  for  treason  and  espionage.  The  FBI,  of  course,  has  a history  of 
using  national -security  authority  to  wiretap  such  notorious  menaces  to  the 
common  weal  as  Martin  Luther  King  Jr,*  John  Lennon,  and  any  reporters  who 
happen  to  annoy  Richard  Nixon, 
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Erodes fca  said  that  all  wiretapping  has  met  Title  III  standards.  * X know 
of  no  case  in  which  a wiretap  was  thrown  out"  for  violating  those  standards , 
he  said,  Not  yet,  maybe.  But  the  current  Ramparts  police  scandal  in  Los 
Angeles  resulted  in  testimony  about  hundreds,  if  not  thousands,  of  illegal 
wiretaps*  X asked  Podesta  how  he  could  reconcile  that  fact  with  his 
statement*  Neither  he  nor  his  aides  could.  They  had  no  answer, 

2)  Carnivore  IP  wiretapping  is  fundamentally  different  from  CALEA  voice 
wiretapping.  Taps  on  switched  phone  circuits,  by  their  nature,  record  only 
the  phone  calls  and  tracing  information  of  individual  lines*  Carnivore,  by 
its  nature,  must  intercept  all  traffic  through  an  ISP  to  find  the  suspect 
messages.  We  have  nothing  hut  the  government  * s assurances  that  it  will  ignore 
traffic  for  which  it  has  no  warrant. 

Carnivore  also  can  read  content  of  e-mails,  as  well  as  addressing 
information*  Under  Fades ta ’ s proposal,  the  government  standard  for 
intercepting  address  information  would  foe  lower , as  it  is  for  pen-register  and 
track- and- trace  information  for  voice  calls.  A pen-register  intercept, 
however , does  not  give  access  to  the  voice  call*  Carnivore  gives  access  to 
the  text  of  e-mails.  Again,  we  have  only  the  government 1 s assurances  that  it 
will  ignore  the  content* 

Not  all  elements  of  the  Po&esta  proposal  are  bad.  He  proposes 
requiring  probable  cause  {the  Title  III  standard)  to  intercept  the  content  of 
e-mail*  And  one  element,  the  removal  of  the  protections  against  cable 
surveillance  in  the  Cable  Act;  of  1993,  is  inevitable,  Whatever  rules  result 
from  this  legislation  should  surely  apply  evenly  to  ISPs  of  all  technological 
stripes . 

The  depressing  thing  is  how  eagerly  the  phone  industry  now  supports 
CALEA,  The  Telecom  Industry  Association  was  involved  in  developing  the  J-STD- 
025  wiretapping  standard  and  Carnivore,  which  was  unveiled  late  last  month  at 
the  TIA- organ i zed  Joint  Experts  Meeting  in  Washington.  "The  FBI’s  program  is 
extremely  sophisticated,"  TIA  said  Tuesday,  Carnivore  works  with  Microsoft*" 
Outlook,  Lotus  Notes  and  other  e-mail  programs,  the  association  continued. 

Equipment  vendors,  who  originally  balked  at  CALEA,  now  consider 
wiretapping  a profit  center,  ADC  l AD C]  just  rolled  out  its  NewNe t CALEAserver 
wiretapping  line*  Mt  receives  the  intercepted  communications  data  from 
various  circuit- switched  network  elements,  processes  it  to  conform  to  the 
requirements  of  J- STD-02 5,  and  then  distributes  it  to  the  appropriate  LEA 
collection  facilities , * the  company  said  proudly  Thursday* 

Converse  Infosys  [CMV7J  also  rolled  out  gear  this  week.  "Converse 
Xnfosys  is  the  industry  leader  in  the  legal  interception  market  worldwide, * 
President  Dan  Bodner  bragged. 

Current  rumblings  suggest  ISPs  are  less  happy  about  spying  on  their 
customers.  Don’t  be  fooled,  though  — they’ll  do  it*  The  Podesta  proposal 
and  CALEA  should  be  stopped  before  spy  equipment  becomes  an  inextricable  Dart 
of  our  basic  communications  network. 

Paul  Coe  Clark  III  is  the  editor  of  Communi cations  Todav . He  can  foe 
reached  at  (301)  340-7788,  ext.  2037,  or  at  pclarkEphiXIips .com. 

LANGUAGE:  ENGLISH 


LOAD-DATE;  July  24,  2000 


5/24/02  Release  * Page ' 


* • 


Copyright  2000  CNBC,  Xnc. 
CNBC  Hews  Transcripts 


i 


SHOW;  RIVERA  LIVE  *9:00  PM  ET} 


July  24,  2000,  Monday 


LENGTH : 1375  words 

HEADLINE?  WHETHER  THE  GOVERNMENT  SHOULD  BE  ALLOWED  TO  INTERCEPT  INTERNET  E- 
HAILS 

ANCHORS?  DAN  ABRAMS 
REPORTERS;  JOE  JOHNS 
BODY; 

Mr.  DONALD  KERR  (Director,  Lab  Division,  FBI}:  Hackers  break  into  financial 
service  company  systems  and  steal  customers'  home  addresses  and  credit  card 
numbers.  Criminals  use  the  Internet's  inexpensive  and  easy  communications  to 
commit  large-scale  fraud  on  victims  all  over  the  world,  and  terrorist  bombers 
plan  their  strikes  using  the  Internet,  Investigating  and  deterring  such 
wrongdoing  requires  tools  and  techniques  to — designed  to  work  with  new  and 
evolving  computer  and  network  technologies . 

DAN  ABRAMS,  host: 

But  now  far  should  law  enforcement  be  permitted  to  go  to  combat  criminals? 
Should  they  be  able  to  cap  into  someone's  e-mail  to  see  what  is  sent  out  and 
received?  The  FBI  says  yes,  and  they  say  they  now  have  a new  surveillance 
system  that  can  isolate  a suspect's  messages  without  invading  the  privacy  of 
others,  an  electronic  strainer  of  sorts.  They  say  it  has  the  same  effect  as  a 
phone  ’wiretap,  a rarely  used  technique  to  monitor  a specific  suspect  with 
permission  from  a judge.  But  others  say  the  FBI's  new  Carnivore  system,  as  it 
is  known f is  an  invasion  of  privacy.,  that  itTs  nearly  impossible  to  isolate 
only  the  relevant  e-mails  and  that  the  FBI  would  have  access  to  far  too  much 
1 n f o rma t i on « To da y t h e debs t e 1 a need  on  Capitol  Hill*  NBC  * s Jo e J ohns 
reports* 

JOE  JOHNS  reporting: 

Fears  that  e-mail  from  lav;- a bidding  users  of  the  internet  could  be  swept  up 
in  a new  FBI  computer  system  designed  to  catch  terrorists/  con  artists  and 
hackers  led  Congress  to  schedule  today's  hearing.  But  some  on  Capitol  Hill 
say  drastic  action  may  be  needed  to  put  the  brakes  on  the  FBI  e-mail,  wiretap 
system  known  as  Carnivore , 

Representative  RICHARD  ARMEY  (Republican,  Majority  Leader} * Well,  1 would 
shut  down  Carnivore  now  if  I were  at  the  agency. 

JOHNS ; Carnivore  is  a computer  application  installed  on  a PC  that  agents 
connect  to  the  hardware  of  an  Internet  service  provider  to  search  for  specific 
senders  and  receivers  of  messages.  The  FBI  needs  a court  order  to  use  it  and 
says  only  targeted  information  is  retrieved,  that  no  indiscriminate  snooping 
is  allowed. 

Mr.  KERR:  We ' re  not  in  the,  you  know,  broad  surveillance  business  in  any 
way*  We're  a law  enforcement  agency  limited  in  what  we  do  by  what  the  courts 
order  us  to  carry  out. 

JOHNS;  But  many  Internet  service  providers  don't  like  it. 

Mr*  CHARLES  ARDAI  (Juno  Online  Services):  I think  our  customers  would  not 
take  kindly  to  the  idea  that  their  private  information  could  be  available  to  a 
government  agency. 

JOHNS:  Still  one  scholar  who  specialises  in  privacy  issues  says  it's  a tool 
law  enforcement  needs. 
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Mr*  AMI  TAX  ET2XGMI  (George  Washington  University)  : Now  more  and  Tore 
communications  advance  through  the  internet  Ard  withmst*  vni-erraAf'!1  , 

FBI  cannot  do  its  job,  Wltn°ut  intercepts,  we —the 

Union  his  filS  ^ i,Tf2ce  a chaUen«e*  The  American  Civil  Liberties 

code-  thatfrhPoirf  d f of  request  demanding  Carnivore  compute- 

Capitol  government  wants  to  keep  secret.  Joe  Johns,  NBC  News,  the 

nw  f5°®  Kington  is  Ari  Schwarts  from  the  Center  for 

Sf,‘S  S°hKfSLlS;  “*«■>«•  »■»£ 

cybersnooping  by  the  feds.  *xUl  * to  dlscuss  Carnivore  and 

Mr.  Schwarts,  let-let  me  start  with  vou 
effect,  than  a wiretap? 


Why  is  this  any  different,  in 


Af r . SCm-;ART2  (Analyst,  Center  for  Democracy  and  Technology)  • if 

dxfterent  in  a few  ways.  The -the  biggest  difference  rinht  m 

"f«S4lS“f  “iff  ??'  toe  the  X«  ik-S. 

« «-vC  , Ovx  s on  to  tna  internet:  s^rvi  ce  DrovirJ^v= 

Even  tno  internet  service  ~ v , *,  p*g\ igs^  , 

different' than  the  S.y  '*a-  n^  - Know  how  it  works.  That**  much 

.*1  P*.c**e~  U«ui-Ujan  phone  wiretapping  happens  now. 

»*■  i , 5*At'+‘  QO+hOUv> t ITS tXOHS  to  VAr  1013*5  « 

to  say,  'Look*  cror  .«  •ra^w  vH,n ' ■ tt4Agu>3  paupiu 


’ s 


lot  ho  d i 


to  <1  effBrr'  rAl  place,  we  ve  got  a system  which  is  c 

oe-son-s  f-!  ,.:S;  . :e  a. phone  tap.  We  can  isolate  exactly  which' 

* * b ~ v,e  v‘ant  tw  *-«P  into.  ' Ana  with,  you  know,  all  of  the 


We've  got  a system  which  is  going 


cyberterrorism,  in  addition  to 


nor 


*.u„  T : %xw  which  is  occurring 

truuugn  v,he  ificti wet , i tm  nfc  a xot  of  paoDie  aiT  ^av^ft  <tv? 
comfortable  ^ x V p *>*/*ng,  x a teex  a lot  iaor* 

,JBOk’  l'he!1"  -“BI  can  be  snooping  on  possible  terrorists.- 


i4v 


Hr , SCHWARTZ r Wei I,  the- 
balance,  and  that's  really  i 
between  privacy  and --and  th 
The  problem  that  we've  seen 
what— what  gets  pulled  out  : 
knowing  what's  kept  in  the  ! 
different.  As  I .said,  we  tu 
can  * t we  just  see  the  code  : 


-there's  n— there's  nothing  at— we- -what  we  need  -:. 
«i#t  we’re  getting  at  here,  is  we  need  a balance 
s— tne  kind  of  searches  that  you're  talking  about 
is  that— the  difference  of  showing  a demo 'about 
rs  different  than  s— than  knowing  the  technology, 
;ogs,  wnat  can  be  retrieved  later  on.  That's  much 
.ve  „x,e  coue  , or- -tor  tne  phone  tapping  system.  vJhs 
m this  case?  “ ^ 


tha^^^^entaD?oteSedh&t  /V?® ar«u"'the  argument  on  the  other  side  is 
right?  pi o tec tea  and  that  it  would  allow  hackers  to  break  into  it, 

Mr  + SvHWAET2  i Wfili  , th-  “thst  f s A V p, 1 y t'V.na  t « | s + 

But,  of  course,  again,  as  I said,  we“have  ?he ‘ same- -«  h KTttl  -®nC^*  *r8* 
network  thft  di?f t8lvpho£*  network.  We've  had  hackers  in“ the~-in“the  Sore  S6t 
co£  S hJvrit*opSU  ' ^ Can>t  We"We  ShDUld  ^ *»  *>1«  to  see  "this 

your  — tf — i fnd"  and  S°  Uiat  S y««r— that's  your  primary  grip.  I mean,  is 

Mir,  SCHWARTZ : Well,  * c?  f->io  ^ ...  . 

_ - s L.ne  raam  concern  with  ramixmrsi 

ff  tL^estSn  of  tLT-ern  ^ivore  raises  and  shows  for  the  future 

stion  of  the  decay  of  the  Fourth  Amendment.  Vfe're  having  a lot  more 

ever  have  inntheSnast  °whe°Tf  ^ Wtems  and  on  third-party  systLs  tha/we 
^ u&vo  in  tno  past  a V?herj  the  f rsifters  of  the  -5  % jtvn  s , 

Amendment,  which  is  protections  from 

government,  people  had  the  files  in  the^  r by  the 

and  knock  on  their  door.  That's  no?  S'c.JTfcda^  government  had  to  come 
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Abrams : Nancy  Grace,  Fourth  Amendment  problem? 

Ms*  NANCY  GRACE  ( Anchor , Court  TV):  Well,  you  know,  of  course  that’s  not 
what  ^ramars  to  mine  when  they  wrote  the  Constitution*  But,  Dan,  the 
Fourth  Amendment  has  been  applied  for  everything  from  abortion  rights  to  what 
you  carry  in  your  car  trunk,  it  can  certainly  be  applied  to  computer  access  * 
My  only  concern  is*  you  know,  years  and  years  and  years  of  Fourth  Amendment 
law  regarding  wiretap  has  developed  over  the  past  decades,  and  that  same  law 
needs  to  be  applied  now  to  intercepting  Internet  communications*  It  cannot  be 
a fishing  spree  on  the  part  of  the  government.  On  the  other  hand,  a warrant 
allows  you  to  open  doors,  open  boxes,  open  mail  and  open  the  Internet. 

ABRAMS:  Got  to  take  a break*  Our  topic  this  part  is  Big  Brother -s 
Watching*  When  we  come  back,  we’re  going  to  talk  about  a sheriff  who  is 
putting  Web  cams  xn  his  prison.  We *11  be  back  in  a minute. 

{ Anno  unc  emen  t s ) 


ABRAMS:  Before  we  get  to  the  sheriff  who  has  installed  Web  cams  in  his 
prison,  I want  to  talk  to  Michael  Nasatir  about  this  issue  of  this  FBI  procram 
tnat  you  can  attach  to  Internet  service  providers  to  basical Iv  look  at  what 
people  are  e-mailing*  What  do  you  think? 


Hr.*  MICHAEL  NASATIR  t'Crimi 
gentleman  from  Washington  is 
libertarians  have  a crack  end 
be  a secret.  The  technology 
t o kn ow  wha  t we  ’ r e ob j e c t i ng 
do  agree  with  Nancy  Grace* 
specific  and  have  the  F— Four 


nal  Defense  Attorney):  You  know,  I think  whet  the 
say i ng  is,  * Look , 1 et,s--let,s  let  the  civi  1 


se®  what:  they’re  really  going  to  do*  It  cannot 
nas  got  to  be --we’ve  got  to  be  able  to  study  it 
to  or  not  objecting  to.  And  at  the  very  least  I 
at  them  get  a court  order  for- -and  keep  it 
th  Amendment  apply  for  sure. 


ABRAMS s Well  — and  I think 
have  to  make  an  application 
I want  to  thank  Ari  Schwartz 


cuere's  no  question  that  there  would  be- -they'd 
lor  a warrant  the  same  way  they  do  with  a wiretap, 
tor  joining  us  and  talking  about  this  topic* 
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ANCHORS;  ANDERSON  COOPER 
REPORTERS  : ANDREA  NcCARREN 
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ANDERSON  COOPER,  anchor: 

. Fe3eral  agents  say  they’ve  coma  up  with  a high-tech  way  to  find  criminal 
PaC®  t0  ?lan  *<*8,  bat  critics  contend  the  system 

soes  tDO  far-  That  is  the  focus  of  a hearina  on 
CapitOj.  tocsy . Here  now  is  ABC's  Andrea  McCarren. 

ANDREA  KcCARREN  reporting: 

(VO)  The  FBI  says  Carnivore  is  an  essential  law  enforcement  too1  -o  ice 
in  tne  rapidly  growing  world  of  cyber space.  P~+ice 

Kr.  DONALD  KEEK  {Assistant  Director,  FBI) ; The  range  of  crimes  that  are 

tat ea  oy  computers  didn't  exist  before,  so  we  now  have  Internet  fraud 
rather  than  iraua  on  paper, 

KcCARREN:  (VO)  The  technology  allows  the  FBI,  with  a court  order,  to  «<*■ 

r!2?L?f  private  ?’“-ails  s«X^ting  out  those  to  and  from  a 
p*ruC^&i  ^rihdta;  suspect,  rut  privacy  advocates  say  the  system  is 
because  it  sorts  through  the  private  e-mail  of  innocent  people,  too' 

the^a^o-^hU— iV*CL S?eC^HSC} ; *c‘s  * iittle  bit  like  looking  at  all 

u'~  c ? °T  a bigh^uy  just  to  tina  the  blue  Honda  vou  want,  end 

extremely  intrusive.  * ' ‘C  * i-  * 

iV0!  ?he  Clinton  administration  proposed  that  the  strict  o-ivacy 
communications  *PPiy  t0  cel*phone  service  be  extended  to  electronic 

‘-'C-ih  P0;juoTA  {white  House  Chief  or  Staff):  What  we're  interested  in  is 
co«u,.g  up  with  a balance  that  accounts  for  the  needs  of  law  enforcement  to 

pursue  pursue  organized  crime  and  narcotics  traffickers  but  also  protects  -he 
privacy  of  individual  Americans.  i—o^ecoo  -ne 

f.rH^"'?SEK:  {10)  ?Y*r  the  l«st  the  FBI  has  used  Carnivore  in  about  2*> 

crimmax  investigations,  ^ ~ 

r^ulr-T^k  Tit  35OWinH  prv5cy  concerns,  the  agency  plans  to  submit 
Carnivore  to  a third  party  for  an  independent  assessment.  The  FBI  wants  to 

public8that  their^onlin^pri^c\T>isSn^otected!:^eAndJne  reassure  the 

, 7 online  privacy  is  pi  o lea  tea,  Anarea  McCarren , ABC 

Washington.  4 
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PRESIDENT  CLINTON  RETURN'S  TO  CAMP  DAVID  TO  ASSIST  IN  PEACE  TALKS;  BX 
DEFENDS  E-KAIL  MONITORING  SYSTEM 
ANCHORS;  PETER  JENNINGS  . 

REPORTERS;  JOHN  COCHRAN 
BODY: 


PETER  JENNINGS,  anchor: 

At  Camp  David  in  Maryland,  day  14.  The  Israeli  and  Palestinian  leaders 
have  holed  up  for  two  weeks  now  with  hardly  a leak  to  the  news  media, 

which  in  itself  is  quite  remarkable.  President  Clinton,  just  back  from  Japan, 
spent  much  of  xast  night  and  most  of  today  in  the  talks,  desperately,  we  are 
toj.d,  trying  to  coax  the  parties  into  some  kind  of  a deal,  ABC’s  John 
is  covering  Camp  David  for  us* 


shn,  looking  at  your  notes  to da 


a am  nis  t r a t ion  o f 
look  good  at  all? 


y,  'Not  looking  good,  senior 
txciaiB  will  take  a miracle,  f say  the  Palestinians,  do esn‘t 


JOHN  COCHRAN  reporting; 


That  * $ right,  Peter.  A senior  administration  official  told  me,  just  a 
short  time  ago  he  believes  the  talks  will  end  one  way  or  the  other  this  week 

not  optimistic.  On  top  of  that,  Palestinian  officials 

vOia  new s,  tney  «eneve  it  will  take  a miracle  to  achieve  a breakthrough, 

Tne  key  s tumb ling  block,  not  the  only  stumbling  block,  but  the  key  one, 
continuing  to  be  Jerusalem,  So  much  so,  that  today,  the  negotiators  s imply 
took  that  subject  off  the  table  and  concentrated  on  other  issues* 


JENNINGS ; So  why  did  they  take --John,  John,  why  do  they  take  Jerusalem  off 
the  cable  and  expect  they  can  get  anywhere  like  a deal? 

COCHRAN;  Well,  what  they  would  like  to  do  is  to  try  to  get  an  agreement  on 
land  and  security  and  they  are  getting  the  director  of  the  CIA,  George  Tenet, 
to  help  them  on  this  security  issue.  If  they  can  resolve  those  issues,  maybe 
they  can  go  back  to- -to  the  issue  of  Jerusalem.  What  they  would  like,  Peter, 
is  to  get  at  least  a partial  agreement  this  week,  something  that  will  enable 
both  sides  to  come  back  at  least  in  August  and  keep  banging  away. 

JENNINGS;  OK,  John  Cochran  covering  Camp  Maryland  for  us.  There “s  the  kev 
phrase,  partial  deal,  Jerusalem  has  always,  always  been  the  final  issue. 

The  FBr  was  on  Capitol  Hill  today  defending  its  e-mail  monitoriiig  system 
the  ominous -sounding  Carnivore,  against  concerns  that  it  casts  too  wide"  a net* 
The  agency  told  Congress  today  it  only  uses  the  system  to  eavesdrop  on 
suspected  terrorists,  computer  hackers  and  other  criminals,  not  on  law-ahidino 
citizens.  Some  people  will  not  be  convinced. 


When  we  come  back,  a plague  of  grasshoppers  in  Texas, 

Mr.  JAMES  ROBINSON  (Entomologist)  ; These  are  some  of  the  worst  outbreaks  of 
insects  for  our  cattlemen  in  the  state  that  I’ve  witnessed.  ' 

JENNINGS;  And  surviving  a storm  off  the  Louisiana  coast.  Was  it  murder  or 
self-preservation? 
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ANCHORS  : JOHN  ROBERTS 
REPORTERS:  JIM  STEWART 
BODY ; 

JOHN  ROBERTS ? anchor: 

lawSLrl^conJerns  ^^?.Capi*oi  MiU  today  to  respond  to 

potential  for  abuse.'  Cri tirs  fear  ®Ur'/®ii1&ace  Pro9ra®  aR<2  its 

so  easy,  it  leaves  ordinarv'LericaS  Cnl^rahfe^  <IR®  f government  snooping 
Jim  Stewart  has  more.  nS  Wlnerable  to  invasion  of  privacy.  CBS* 

J I K STEWA  RT  1*  <gp o r t i-nq ; 

Every  day,  more  than  a billion  e-mai  1<?  «,•,„  . • 

users , and  the  FBI  tMnV«*  " 1S  ® sent  and  received  by  computer 

guy.  But  the  problenTfor  acet ?U8t  a®  fon?  of  them  as  the  next 
all  the  gibberish  to  find  «y meani nglul  evi  d2£*  ft/ZrlT^°Ugh 

£K,“  tfclnte  “’*  £o“-  «*  -»■*'-  in  ;“«tra^siS  S3S  “M 

Mr.  LARRY  PARKINSON  (General  Counsel,  FBI!:  This  •*  s-deso-' <-e  ,>n 
unfortunate  name,  this  is  a tool  that  is  very  surgical"  P * 

it  'S'nSthing^orf'thin^  Sl^o^utef  tL^B^ca^l0” "%*'  Ph^icallV' 
*“»  of  “ «*wm  ..me.'  SS,  ISToSS?* 

of  reaomg  every  AOL  customer's  e-mail  it**-  LS  , m:  B I instead 

lust  the  7T3^s«sao^«!  ___>  r * ^ V -*£S*9nk-d  to  *ero  in  and  record 

J a.wsages  sent  to  ana  from  one  particular  e-mail  address, 

KERR  (Director,  Lab  Division,  FBI!  * We  don  * r-  ■.  ^r,  , 

or  surveillance  with  this  ««•►«,  1 \ ve  aor>  t «°  broad  searches 

in  my  view  could  not  be  ' ihat  8 not  etherized  by  a court  order  end, 

STEWART:  Critics,  however,  immediately  asked:  Who's  watching  the  watchers? 

STEWART:  The  reason  for  the  skepticism  is  t-hrtra* » u ^ 

between  wiretapping  the  Internet  and  wiretapping  a telephonl  if^h 
to  hug  your  telephone,  they  get  a court  nrH*bi-  ^ ^ th&  FBI  wants 

the  phone  company  makes  the  connection  for  f L w£  to  H-e  £hone  company,  and 

wiretap  your  Internet  addres^^h^  get  a coSrt  order ' , J*  WantS  to 

the  connection  themselves,  Y g urt  or^er  and  then  they  can  make 

They  ve  done  it  16  times  this  year  already  T 

hackers,  and  the  potential  list  of  ^ &§temst  Internet 

aa^nre  x ij.se  or  suspects  and  their  crimes  is  arowina 

agents  warned.  Four  years  from  now,  the  nuir iber  of  cojumerri^  ^ ' ?7?mngi> 
alone  is  expected  to  top  200  billion  * WAr.  commercial  e-mail  messages 

Washington.  millon  a yeax  ‘ Stewart,  CBS  News, 

ROBERTS:  And  next  up  on  the  CBC  FVPttTMn  'Miywe  ~ , 

V wii  ujc  EVENING  NEWS,  a new  scheme  to  bilk  the  old 
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and  steal  their  trust, 
{Graphic  on  screen) 

CBS  Market Watch 
DOW  JONES  INDUSTRIALS 
CLOSE  dawn  48.44  10, 685.12 
NASDAQ 

CLOSE  down  112 , 88  3,581.5? 
CBS  - MARKETWATCH  - COM 
{ Annomicemen  t s ) 
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FBI  FIRE  FOR  USING  INTERNET  SOFTWARE  TO  WATCH  SUSPECTS'  E~ 

REPORTERS:  CHARLES  OSGOOD 
BODY: 

CHARLES  OSGOOD  reporting: 

THE  OSGOOD  FILE.  Charles  Osgood  on  the  CBS  Radio  Network. 

The  FBI  is  able  to  read  supposedly  private  e-mail  and  oth*r  intern#* 
tratfxc  using  a svstem  called  r^rr^wnr*  t Q";  internet 

dictionary  L ^ fiL£  ttf'  Uar**voxe,  Carnivore,  according  to  the 
is  any  ilesn-eetino  animal  n-r  ^ „ 

u»  OI  plant.  Not  to  worry#  says  the  FBI, 

Mr.  LARKY  PARKINSON  (General  ro^wl  rw*. 

this  is  a tool  that  is  very  — J DeBpite  xts  ^tortunate  name 


ry  surgical 


OSGOOD:  Where  have  we  heard  that  before?  Stand  bv, 
{Announcements } 


OSGOOD:  The  American  Civil  Liberties  Union  is  conce-n^d  to  -w  ^aey.. 
about  the  FBI’s  Carnivore  system  for  snooping  on  £e  Internet  * " S!" 

Unidentified  Kan  Si;  This  is  the  equivalent  of  coinc  to  the  no*-*-  n*fir->  •»•** 
stationing  an  FBI  agent  there  Iook<ncr  at  t»~e  / s pc"  °iC4-t,s  3TJd 

letter  that  goes  through.  ' ~ C accessing  intormation  of  every 

Dona?d°KerrK°'  Xt’®  nothing  like  that  at  says  the  FBI  Lab  Division's 

„.L vei^S^KffRtiFBI  Lab  Divisior') : »«  don’t  do  broad  searches  or 
surveillance  with  this  system, 

OSGOOD : The  bureau  is  bcino  v@rv  ako  auAn+l  . - , 

civil  rights  with  Carnivore  > i-uL  — P ^°w  violating  anybody’s 

^naore,  say^  tne  r*>I  general  counsel  Larry  Parkinson. 

-Vi''  ^'^KlhSQN:  Tnis  is  a tool  that  is  deployed  rarely  and  it  i<*  never 
deployed  without  a court  order.  * ll~  iS  ,xever 

nP  ?!f°2D:/n  ?ther  words'  ’Trust  us.*  'Not  good  enough,'  savs  Alan  Davids™ 
t5rie  Center  for  Democracy  and  Technology.  n Davidson 

access  r^,i^VIDS°N  (^nter.for  Democracy  and  Technology).-  Carnivore  has 
^ k L ?w  l information  than  it  is  legally  entitled  to  collect  How  do 

2£»*a,«£St5'“  C,,rr-1TOI'?  “O'*  *>  “•  *■»*  «h«  kind  .f  lSSh  h« 

£» 

Mr.  KEVIN  DiGRRGORY  (Deputy  Attornov  General)  * m*«v  - - 

confront  every  day  in  the  Shvsical  ^rid 2™  til'  Y ?f  the  crimes  th«t  we 
world.  Physical  world  are  beginning  to  appear  in  the  online 

the°online  world^to?  tbat  occur  the  physical  world  occur  in 

onixne  world,  too.  That’s  why  Congress  is  now  taking  an  interest  in 
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Carnivore.  John  Conyers,  Democrat  of  Michigan, 

^tPl^TntatiVe  Z°m  C0HYERS  (Democrat,  Michigan) : Constitutional  richts 
don  t end  where  cyberspace  begins.  * rente  s 

is  °th»rp*«Aia?  1 ''  t|!e  ?fX  ls  as  scrupulous  shout  using  Carnivore  as  it  savs  <t 
* • » always  Murphy’s  Law  to  consider.  That's  the  one  that  savs  'if  " 

Alabama?  °*  Can  happen'  1C  win-’  Republican  Congressman  Spencer  Bachus  of 

abuKP her? T “CB°S  (RepufaUcan'  Alabama),  The  potential  for 

OSCOODi  THE  OSGOOD  FILE.  Charles  Osgood  on  the  CBS  Radio  Network. 
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Justice  Department  officials  defended  its  “Carnivore"  e-mail  scanning 
program  on  Monday  in  front  of  a House  panel,  saying  it  is  "narrowly  focused’1 
and  they  have  used  it  just  25  times  in  two  years,  including  16  times  so  far 
Yeaiy  discriminating  between  users’  messages  on  the  Internet  ...  is 
exactly  what  Carnivore  does, “ said  Donald  Kerr,  assistant  director  at  the  FBI. 
it  does  not  searcn  through  the  contents  of  every''  message  and  collect  those 
hey  words  like  -bomb'  or  ’drugs.’  It  selects  messages 
on  criteria  expressly  set  out  in  the  court  order,  for  example,  messages 

account  or  to  or  from  a particular  user." 

. *■*  told  ■-he  house  Judiciary  Subcommittee  on  the  Constitution  that  a'U  but 
hut  program  this  year  have  been  for  "national  security  reasons, » 

&h  "r6  5ases’  Attorney  General  Janet  Reno  has 
inaepen-e.,t  fevi?w  0"  lha  system  to  determine  whether  it  infringes 
on  p,i\a<.y  rights.  T,.e  American  Civil  Liberties  Union  has  filed  a Freedom  of 
Information  »Cw  request  with  the  department  for  all  documents  related  to 
Carnivore,  0-  w 

, Ae°riier  internet  file-trading  service  is  facing  a lawsuit  by  Hollywood 
neavy'  hitters.  Scour .com,  a site  that  searches  the  Internet  for  music  and 
wdeo  files  ana  allows  users  to  exchange  them,  is  the  target  of  a coDvrioh*- 

?ux5;  5^led  New  york  by  the  Recording  Industry  Association  of 
Amepca  and  the  Motion  Picture  Association  of  America.  Scour.com,  which  is 
backed  m part  oy  former  Disney  head  Michael  Ovitz,  said  it  was  “very 
surprised"  by  the  lawsuit,  because  the  company  had  been  in  recent  talks  with 

SpsterSShP^iS . *T-  aS  SOry'  M Chairman  Jack  Valenti  called  the  site 

The  ^recording  industry's  case  against  Napster,  meanwhile,  goes  to  trial  on 
Leunesoay  in  San  Francisco.  Lawyers  for  the  major  record  labels  are  expected 

in/cipwS^SrSo^nfT  b?fause  ic  allegedly  promotes  music  piracy 

na  copy* J-ffh-  infringement.  Napster  allows  users  to  share  MP3  digital 

f i*nM?L ° i » ^tng - ar®  cornPact~disc  quality  and  can  be  downloaded  in  a 

that  Napster  has  given  millions  and  millions  of 
Nans  ter  CFO  Ha  n k^R  - 1 1°  Sear music  they  haven't  heard  before,"  said 

exl^c-  it  ?o  S Sfcklv  k Vimes'  ExP8rC»  watching  the  case  don't 

?ulcCay"  issues  are  complicated,  and  Napster  has  amassed  a 
battled-haidened  legal  team  on  its  side,  Q ~ 

K,  -itefBtfr'S  bas  recently  drawn  « lot  of  the  madia's  attention,  but  the 

h oiggest  case  is  still  simmering  in  the  background.  A federal 

judge  found  m June  that  Microsoft  had  used  illegal  and  unfair  tactics  to  oush 

SuLemedCour tPep'« t 1 ??  sYstem,  and  the  company  has  one  appeal  left  - to  the 
Supreme  Court.  But  the  case  might  have  one  last  detour.  Microsoft  wants  to 

court  ?ofhf^a^antlferUfte-aW  enacted  in  the  i970s  that  would  allow  a lesser 
court  to  hear  the  appeal  first.  According  to  the  Washington  Post  thf> 

company’s  lawyers  believe  the  Supreme  Court  would  benefit  from  another  review 
factual  and  procedural  issues  rn  the  case.  The  government  and  the  company 
more  P«P«rwork  on  the  issue  m August,  and  the  Supreme  Court  could 
moke  a decision  by  vhe  fall  on  whether  it  will  hear  the  appeal,  0- 

forSaeP^okK^g,,^«fa^«  ff£ered  **is  new  serial  novel  "The  Plant"  on  the  Web 
«we  L,o  P,  ■ 06  because  he  wanted  to  test  how  people  would  respond. 

We  have  a generation  of  computer  jockeys  that  we've  raised  on  Naoster  and  MP3 
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ifcho  have  gotten  .»  * * the  raistakon  id^a  thaf  v-u 

And  l*d  like  to  see  if  we  ran*  ? th?  «*««  is  free. 

fruits  of  ^ ^ jreeducete  these  people  to  the  idee  that-  t'ha 

. , U1 , or  talent  cost  yon  money,*  the  author  m hn^/ ,««,  «~!  n * 

Morning  American  Headers  can  download  day- ?n  ABC  s Goo& 

Without  paying  the  $1,  but  according  rJ ltStJ ^Portions  of  the  book 

the  story  folds. » ^ i£g  If^rSt'o/S  £«; 

order  to  keep  it  going,  it's  available  at:  pay  the  stor>'  *» 

nt tp ; / /www , s tephenking „ com/download . html  0- 

A French  judge  has  ordered  a series  of  teats  ^ nrr  t .u _ ^ 
screening  software  works  well  enough  to  reSK 

prohibit^the^sale^r'^exhihiti °nl^f 6 • auctioi?s  of  Nazi  memorabSi^Frencflaw 

June  ordered  the  Web  company t^bl^SeS ^the^et^0"®*'  S°  a judga  ln 
auctions  are  legal  elsewhe’**-  v»h,-w.! '..access  to  the  auctions.  Because  such 

fr.yahoo.com  site,  Lhoo  ST** ?\ ifcsm fiance-oriented 

that  it  doesn't  have  the  means  to'keeo  portal.  Tne  company  argued 

auctions  outside  of  f>  yahoo  com  , *Serf  tZQm  acc«ssing  all  the 

should  be  tested  by  expert-  befor^he  m-v?«  ^^•Jacques  Gomez  said  that  idea 
nn'i-M  fa,-.«  r.Lk'  Dercie  be  maxes  another  rulinq  in  Auovst  vahn^ 

coaid  face  hundreds  of  thousands  of  dollars  in  fines,  0-  vgUot*  yahoo! 

in  an  attempt  to  get  the'  v~4i™a  comoan /?fn9  service  h?ve  baiuted  together 
real-time  Internet  chatters . "rhe  MSN  Network  A hyge  cor^«ity  of 
Tribal  Voice  have  formed  a coalition  C°T  ajld 

them  connect  to  its  m service  ' V^4i£°v*i  * * wi*!  push  A0L  to 

group  might  end  up  with  the''covernmert~on  it-  tide  °f  ysers*  The 

many  that  the  Federal  Communications  CommissioTSill  cSnside^w^h-rtd®  °£* 

4.t  uOrds  a hearina  on  the*  o^ano^d  Aiv  jts-,*  >>  * COI3Slaer  or*  Thursday  when 

gJSLassr  h*s  - 

18  certain  its  IK  market  share  won't  be  affected,  'o-  U y Slvs  in  when  it 
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^ SYSTEM  TO  MONITOR  E-MAILS  GOING  THROUGH  INTERNET  fJERVTPF 
PROVIDERS  CALLED  UNCONSTITUTIONAL  BY  MANY  AWU&KNET  SERVICE 
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BODY: 

BOB  EDWARDS,  host: 

s/sss1;?  tor  °» 

.uvest*gators  search  ter  evidence  by  sifting  through  huge  volumes  of  e-mail 
mveJ-icat^on  ?h Trnr^K^™1?0™  e^oses  law-abiding  citizens  to  an  FBI ' 
be  trusted^because  °f  Coa9res®  >'«sterday  that  the  system  can 

Larry  AteLfon  rejects  ^ nSS  m8ssages  Levant  investigations.  NFS' a 

LARRY  ABRAMSON  reporting: 

o&uet liy  the  FEX  ssks  Xuteme t r!»r«  ♦* •> 

*«,*.**  „ Ttvv.  ; \r  providers  to  do  its  eavesdropping 

th-  *?*,!cy  h“  b**!i 

With  special  <snefwa^o  •ru.-l'-a-  ~~  “ name,  vw.^.y.e  is  gust  a computer 

Internet  -e-v®ce^  insHils  the  in  the  offices  of  the 

eve^t  X L?:  d * a biS  vacu«®  cleaner.  Carnivore  sucks  up 

t ™TfTSe. **nt  or  received  through  the  provider.  But 

the  S bits  th»t  aLSre?”fA1  *erf«'  c*ralv««  sPits  °«t  everything  except  for 
une  x.cA  *>aCs  tnat  are  rexettod  to  the  investigation. 

Mr.  DONALD  KERR  (FBI } c What  it's  *. 

the  addf€^«aa  ^ + ^ 0.  ‘ 4 s ■ oasicaA*j  allowing  as  to  ao  i s record 

outside* of  the  envoi one"  f®  &flt  and  the  return  address  on  the 

to  lo  MtrXi  rtl  1 not  permitted  to  read  the  subject  line  and,  in 
U°  not-  capture  that  and  record  it, 

™^B^S0N!it,S  3 lot  hard8r  for  the  FBI  to  get  court  authority  to  actual's v 

* The  fB3C  assured  ambers  of  a House  Judiciary  J 

»ub~om»atLee  that  Carnivore  software  can  be  carefully  tailored  eh-.t  ,■  ~_,„ 

usef  theLT^  °Lthe  "“***  and  the  recipient  of  a^ssXo^  XgantsLave  Y 

GrefoS^  L& "S  °l  searches  on  telephone  lines  for  decades.  Kevin  Di 

® * * Wibh  the  Department  of  Justice,  says  they're  very  useful  in  the  »arlv 
stages  of  an  investigation,  * Kltti  ln  cne  early 

Mr.  KEVIN  Di  GREGORY  {Department  of  Justice):  To  illustrate  law 

buSnatff  i?ffn1needa  to  find  out  from  whom  * dealer? fir  instance  is 

It  is  therefore^ important  ?l  th*  dealer  is  selling  his  goods, 

communicating  P an  CO  detralM  Wlth  whom  the  drug  dealer  is 

<nto2XS2{ i&th^  th8  systeffl  has  to  P***  at  each  bit  of 

sssx ;*  “ ? ™ar?i,  Kanhr“*srs  °£  «- 

SSJ  SS.?L2«d“r““  C"“  0ni0“  ai«  th.  potential  for 

Mr.  BARRY  STEINHARDT  {American  Civil  Liberties  Union) ; Never  before  has  law 
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enforcement  installed  a device  which  access  all  the  ■ 

service  providers  customers  rather  communications  of  a 

of  a particular  order.  h 0nly  the  CORKRUn3-cations  of  the  target 

ABRAMSON Internet  service  providers  have  become  „ 

and  subpoenas  for  information  in  criminal  ;^.a«°^'CCUSt0^?  to  court  orders 
“W  say  they  t.str.t  th.  S“. “sf;S?*“L But 

K£Sr,SS  SS  T-—  *f c4rKLih‘ *bS*2?/S"  * 

«-  i™xsrs  2Lsr^iS^ssii^“ttori'»  «»a  “w« »»»»«. « 

is  w^r!5!^31' BAER  (Georgia);  you're  saying,  'What  we're  Croatia  «-r>  - 
is  we  re  going  to  go  outside  of  the  law  here  hsH«  ,v  w , e go;n9  to 
force  you  to  allow  us  to  out  «.»•  u basically  and  we  re  going  to 

able  to  monitor  it.  it's cL^ietelf  VhUr  ®i'stera-  *»»  will  not  be 

You  just  give  us  access  and  we~ll  do  our  fhing?^*’  'ihmK  you  very  much'  fiwys. 

^“S^Sefs^d^ma tUTl^  IntefT 

Seriate. 

extending  ...at  analogy  to  Internet  service  providers  doesn't  make  S’ 

Mi  v STUART  BAKER;  To  say  you  don't  have  an  expectation  rvr«iw 
information  that  i«j  in  the  ku-  ^ expectation  of  privacy  in 

' r ■“  1 ^oe  ndkJ-as  tne  thxra  party  xn  the  >t~ 

jt.&t  crazy.  X mean,  our  enti  re  Hvpr-  ,****  ^ --  * „ ;L^ine L is 

' «^ua  uve,$  axe  in  tne  hands  at  third  parties. 

Th*  yBI  is  offering  to  hire  an  independent  invest<oator  -o 
if  iinh°re  °ffers.a  constitutional  way  to  wiUtap  on  the  feterrf  n-i 
.ar,  vhe  agency  says  it  will  not  reveal  the  snfrMr/^l  v V , f &Jt  so 
Many  civil  libertarians  say' that's  «5' fv  t code  behlRd  the  system, 
that  Carnivore  is  dangerous  ^ ZT*i  a thty  cm  prove  to  Congress 

News.  Washington.  SCOuia  abandoned.  harry  Abramson,  kpr 

LANGUAGE:  English 
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F?X  DPEJG>S  CSE  OF  E-MAIL  MONITORING  SOFTWARE 
BYLINS;  By  Frank  James,  Washington  Bureau 
DATELINE:  WASHINGTON 
BODY; 

technolow  Iawmak®fs  on  criticized  the  FBI  for  using 

monitors  e-mail,  claiming  that  it  threatens  privacy  rights 

r m»*ieTiX:LtlZ  experts  Bfy  tho£3e  concerns  miss  the  point : By  its  very 
nature , ©"iruail  not  secure,  Electronic  ^ ^ . *'  y 

send  private  information.  messages  are  among  Uie  worst  ways  to 


'omouSrgeSe*-  subcommittee  hearing  Monday,  Tom 

8!hy^f!‘-ePthat  ft®  ran  out  of  time  before  he  could  . 


: Perrine, 
explain  to 


lawmakers  that  it's  not  just  government  snoops  using  a special  secret 
software  program  like  "Carnivore-  that  threaten  e-rrlil  privacy! 

wlth  * little  computer  know-how  can  catch  and  read  other  people' 

l^atnT?et'  he.?rd  othsr  say,  is  a simple  encryption  ' 

program  wh*t  codes  tine  e-mail  so  others  can't  read  it,  ^ 


'li  everyone  used  s cron a 


encryption,.  large  parts  of  Carnivore  would  bo 


completely  useless,"  Perrin©  saidV  ’ wouio  ^ 

doubtedhthe  ^Bl>s°eL^^i?9^D^rati\and  R®J>^ican  skeptics  openly 

?-°  KeeP  abusing  its  Carnivore  technology  a^d 

telephone  TrlltT  ^tutional  rights  with  the  Internet  eguiv^  oCa 

to  capture  ,the  a??ncy  has  GUietly  used  Carnivore 

*lir»^iK  ,5®  ar‘;i.  fr®"*  iane*  of  e-mail  between  certain  suspects  and 
raSir^uthfeSv^tVe^^f*^  judgas  have  Provided  the  agency  with  the 
L f f lfi°  hss  ca-Dnure~  not  just  the  address 
~n tor mat ion,  put  the  content  of  targeted  e-mails. 

, f 1 i 'ra oy  experts,  lawmakers  and  others  have  sharply  criticised  f-he  p&r  e^v- 

its  use  of  the  program;  Monday’s  hearing  was  filled  wi^ha^^i^!  of 
privacy  violations.  accusations  of 

f^r  "t'ohter  r^?^Sf  haS  t0  *£c' ” said  ReP-  Jerrold  Nadler  (D-N.  Y. ) , calling 
°f  t-Shter  restrictions  on  the  FBI.  “Police  agencies  can't  be  afforded  9 

untrammeled  discretion,  and  we  can't  assume  a lack  of  bad  intent  on  the  mart 
Of  police  or  the  presence  of  goodwill  is  enough  to  protect  people's  p5vlcy!» 

are^cLck-  andebffJnnfOUn^v'  Mrry  Parkiasor"  assured  the  lawmakers;  "There 
«w»  f K and  balances  with  respect  to  Carnivore.  ...  it's  not  a situation 
v,here  & rogue  FBX  agent  could  broaden  th&  covpr^o^  of  th&  "V" 

and  violate  the  court  order"  authorising  the  SeiflanS.^ Carnivore  intercept 

fcfhat  the  numerous  witnesses  defending  the  use  of  Carnivore  as  ~ 0 

.ctaowl.ds,..  however,  was  tS  tSoo 
y “'tJ-  agree  on  v.he  insecurity  of  e-mail  in  general. 

President  Clinton  knows.  After  a speech  last  March  in  Silicon  Valiev  a<s 
s~nf  *5  columnist  for  the  San  Josf  Lrcury^ews 

♦bOifioone  ssScsd  Clinton  xt  h©  keen*?  4r>  t'Anr'Vi  c y tvew^,, 

Chelsea,  by  e-mail  while  she  isaw^y  at l^nf^  UniversfIJ.  daaghter' 
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secuLf«nsai|°ciinton.Wifch  CheIsea'  ^olutely  not— I don't  think  it's 

SupScoSter1  ?ent!r^t  **  the  *»  «•» 

worries  about  protecting  t^ir  vf1  fotnia“San  Diego'  everyone 

information  by  i-^il  computers,  but  too  many  send  sensitive 

goes Trvin«0fo * ^ "ish  1 c°“Id  ^esiember  who  said  it,  bat  basically  it 
concrete  bunkers  surrounde^bv^arhfn^^  ****  Internet  is  like  two  people  in 
written  oa  t£*^  S*"*  “"“®~  t0  eaCh  oth^ 

«^SS.*iL2S*t  rsr£S£X  “n  *?  ”*a  * 

said,  tIK  ana  technology  called  a packet  sniffer,  he 

E-mail  transmitted  over  the  Internet'  i^v*  -- ; -t  , . 

«<*•!  M,  is  broken  into  JhSi!  billed  !*"'  tte  . 

s?®K*r  tovrJ”  ;«-tK  ch* 

nn/nt  « f1'  ^ packets  otten  take  different  routes  to  get  fr«  »i>r Vt-r 
point  B,  bouncing  around  the  Internet  until  thev  ar^w  ?t  thfit  A,  " 

and  are  reassembled,  y ax~~va  at  their  destination 

sniffer  can  oollect^the^pactets^cnV^f^^le0^^^11?  ®iSe  Psirig  a Socket 
an  e-mail , leading  to  eto  security  Lsue^SiL  Sised.^ “ tft*  eont««  <* 

ihe  greatest  cause  for  concern  ■is  «-he  nn^diVsine,,  • . » , 

„t,  to  the  powerful  computers  known  as  servers  i-he  r 

networks , said  Richard  *&»*  f-b  ~>v>  cne  ora  ins  of  computer 

Mass.  °"‘Xl'h'  an  internet  security  expert  based  in  Cambridge, 

*i,n  the  case  of  Chelsea , t h<&  rAnpor>A  r *.wo  ^ u _ 

the  Secret  Service  is  * f have  as  .*.  resident  Clinton  or 

^ C:T,  service  is  what,  somebody  at  Stanford,  or  wherever  v?h^ 
tne  e~n\ai  1 system  was  w&tchincr  that  t tains 

tabloid  fnew^aoe-'f  r*  ?£  traffic,  that  they  got  $10,000  from  a 

reas^:-  he  slid  those  e“,Bai18  «**  «»  Chelsea  for  whatever 


Sensitive  corporate  informatior 
when  they  are  mentioned  in  e-mail, 
format* 


on  and  trade  secrets  are  equally  vulnerable 
x ' whlc^  nas  roots  in  an  easy - to-read 


xf  anything  cried  out  for  heina  ^ncrvrt-p^  r . wv,>^  a * * * 

said.  -Maybe  over  time,  that  cant!  * »*«■ 

allASmpuSr  Serf  U"h™S??hi0R  t£olB  are  cu«^ly  available  to  virtually 
emplS  afaerS<  ,'hOU3h  they  taKS  knowledge  of  computers  to  properly 

®5ierts  foresee  growing  consumer  demand  for  encryption  «m  c-n 
expect  that  as  people  learn  that  e-mail  is  not  secure  there'll  hi' 
interest  xn  using  encryption  to  protect  it  * *aid  11  be  more, 

scientist  with  AT&T  Labs.  “Most  people  now' don't ust <t research 
interested  in  it  or  it's  not  t„  .r®  , usf  *c  oecause  they're  not 

that  comes  with  their  computer."  ° :'®®  113  the  standard  configuration 

an  ?2t?rnet  enSioeering  standards  grouo  recent ’v  dewi^ 

Sf«*“3£“ couU  hast“ °»  ^ *«  <*pi.  iiL?rSVSS?SV 

cases  this  would  be  trLsparent^t^the^s!^"  h!ffi<T  ^hof^f  fr^  in  most 
they're  not  already  here,  are  at  least  on  the  horison.'*  **  technologies,  if 
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ACLUhforBa  privacy  *rw>**  and  the 

passing  through  networks  connected  to  the  "device  e:nail 

•Carnivore"  by  the  FBI  --  because  it  alt%  »? tu  . aufobed 
dangerous  because  it  is  caoable  of  scanr < o£  Piortr^tion  — is 
along  with  the  subject  lines’ of  a2d  receiver  information 

mcssaaes  ‘"'L^  mail  to  det  exits!  ne  if  those 

:"  oriw?xn  information  worth  saving  for  FBI  review  nnHif*  ^ 

Carnivore  s almost  unlimited  access  to  Unlike  phone  taps, 

potential  for  abuse  by  ov^-ealous  FB?  S??®S  c\rries  « high 

targeting  users  not  suspect  of  any  L'ile  *XXOWS  tb*  Possibility  of 

information  from  ISP's  an  Possible  in tLi  ? 'e  1 lnes  or  gather 

electronic  mediums  like  e-mail,’  but Varni varrxed  °ut  over 
system  is  an  untouehab"* *»  box  iso'~*!  more  pervasive.  The 

information  nassit °;lea  on  P^vate  networks  to  collect  all 
passing  tnrougn  them*  This  is  I -?*<=>  ^ : \ *** 

listens  to  everv  phone  co iL  ? ^nsu*Uxng  a device  that 

calls  should  be' monitored  or  not  the  Phone 

workings  of  Carnivore  remains  sketchy’  ‘^Y* in£omatfon  °«  th«  inner 
like  Representative  Bob  Ba--  S Prxvacy  advocates, 

•Frightening.  - ' 1K“^}  * *no  ***  one  word  for  the  system; 

independent  groups ^who^wouL^exemi^e^i of  Carnivore  to  be  perused  by 
being  collected  is  lira-5  ted” to  gkX”f?  to  make  sure  the  information 

This  seems  a viable  solution,  aslheLttL^v^of9?^0?  f°?  illesal  ««tivity. 
not  be  violated,  yet  could  still  be  mentored''  tL  r»-CarniTOrGJSystem  wouid 

Carnivore  could  be  reviewed  by  independent  fxid*y  that 

enough.  '<w.t,B,iac.,c  academics,  but  this  does  not  go  far 

turning  over  inforLttion  o^' ^a-aetedQ"^1V°rf  W0SJa  ieave  ISP*s  responsible  for 
practice  with  phone  c^anies  if ^Le^<on  of  P*  ^ieW=  a*  *a  the  current 

allows  some  decree  of  protection  °f  xncrirainatxn3  evidence.  This 

widespread  electronic  surveillance?  d 58  a reasonable  alternative  to 

More  sweeping  reform  could  come  from  Cooore*>«  ac  , . 

S if  recfasendation  to  «taft  legislation  that  wuld^f iff cfff4frine-the 

^ ^ ^visions  ensuring  that  access  to  * r\  , vxve 

enforcement  is  limited  to  suspect  users  ar-d  „„???  communications  by  law 
only.  The  potentially  abusive  fftufffl  Cafnf™  if  fffrt'app?0ved  targets 
learn  to  live  with  in  the  digital  aoe  Laf-fSfff  ? som®thlnS  ««  should 

privacy  infringed  by  law  enforcement  agencies  interested*in  *^\**v*  theiv 
a few  criminals.  y *nceie&ted.  in  collecting  data  on 

wi de°rf ^ heep  up  with  the  times  and  fully  examine  the  feasihi  1 i tv 
wide-ranging  changes  to  electronic  privacy  Outdit-Ji  1,?  feasibility  of 

oie2^agfsCwi^rhatiT  PriVSCy  Act'  whi^  allowf  for^eh-LmeLnJePeLfS 

ox  messages  with  a court  order  ?- n t _ v*  time  interception 

t«taojc«os  «*  ,lta  fOT  toPhSL‘-nk;  sSvSr“°nB  £or  new 
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' cod®  18  opened  to  public  investigation  or  more 
attention  is  paia  to  governmental  bodies  engaged  in  electronic 
Sf®1  the  laws  ara  far  behind  technological  means,  ft  is  time  the 

unreasonable  searches  folate  Fourth  Amendment  protection  from 
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Hill  wiretaps.  Carnivore  System  Faces  Fire  on 

BODY^" : JOhn  SchwartE  ' Washington  Post  Staff  Writer 

Federal  law  enforcement  officials  defended  ’Carnivore*— the  FBI’s 
controversial  Internet  wi retan  evehm..  IZ 1 0 **  s 

of  grilling  by  Democratic  and  ph  moi e than  two  acrimonious  hours 

chilling  picture  o?  an  IntSet  ?w  ™i  Yesterday,  painting  a 

terrorists  without  prSpS  s^iSance  ^ haven  for  c«**»  ««* 

anonSSnaeL^ter™uni^t-Ser!d  Pornography  to  each  other  using 

® ™ufe*  encryptea  cossjm  i cat  ions,  " FBI  Assistant  ni  x* 

told  the  House  Judiciary  subcommittee  on  t^  Constitution  I *frr 

financial  service  companies’  systems  and  ' >,  *1*1*  brsak  inCo 

credit-card  numbers,  criminals  use  the  l presses  and 

communications  to  commit  large-scale  fraud  on  victims  all  over  t ha 
terrorist  bombers  plan  their  strikes  using  the  Internet!’  ' *nd 

Many  or  the  lawmakers  seemed  just  as  concerned  with  the  nf  •> 

enforcement  officials.  ’The  potential  for  abuse  here  is  t-e-endovs  PW 

Spencer  Bacnus  CR-Ala , ) . “What  you’re  saying  is  ’Trust  us!—  ^ Kep' 

taQwn’as”® ’ "packet^snif f er^*  network -maintenance  program 

to  quickly  collect  Sst  the  -S’  and  fr?at  fPecificity-the  ability 

for  v r 3x^.0  4.rom  information  in  o-mail  mossauss 

iqi  example,  and  not  online  bankino  t ^nescHAne  ^ 

the  equivalent  of  the  teleohonV  n^ti°ns  That  gives  law  enforcement 

* ^ t / ^ ut,^epiio*ie  world’s  "pen  register"  and 

aa.a-the  origin  ana  destination  of  all  calls  related  to  the  subject . 

Civil  liberties  arouos  and  lot&root  ^ 

“^ifcutisl  reasonable'  sSrch  Ind^Surflf 
newteciloiogy  also  c^S^r!^ 

S2SSt“  “tS  °£  information  from  innocent  peoplelfwell^fthe' 

The  critics  also  note  that  pest  experience  has  shnw  - u h . , 

has  overstepped  its  w<  na®  &nown  that  law  enforcement 

iltu  iCB  w^ietap  authority  numerous  times  in  the  past. 

' 4,ssociat®  Erector  of  the  American  Civil  Liberties  Cm  n- 

Jf ^cesSing iS  rOU^  bivalent  to  a wiretap  clpSlt" 

customers  * ^wi  th^the^  ^assurance^tha  t VtheaFBinwi  1 ^ ^5^  company?* 
the  specified  target."  FBI  record  only  conversations  of 

the  netlorks^TheJ  want 

^ publish  information  on  the  software  used  so  that  ISPs  can  hl  ™!f 
that  it  does  what,  the  agency  says.  Xb  can  by  Slire 

..  Jbe  la?  enforcement  officials  pledged  to  present  the  system  to  a r^.r^i 

thira  party  for  review  but.  said  thev  «mwm>  „ a/suern  to  a neutral 

the  system  that  it  will  b»corf>  a .L.  %■  ^ ie^ease  so  ^uch  information  about 

' Wiil  become  a target  for  evasion  and  hacking. 

They  insisted  the  Carnivore  system  actual  1 v nrmri^.  ..  , 

what^the  rS°dS  f ^atherinS  electronic  infoLation  because  U can^iL-June 
wnat  the  machine  nands  over  to  investigators.  can  -ine-tune 
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t ITU™'*  *rlSk  their  in^rity,  their 

h.  Barr  Jr?  1r -Ga  " twS " c ongr es s^rTr a rli y Jrth^sfme^idi^f  ‘ Y‘  >-'“nd  Robect 

N&dler  peppered  the  f'ff-iHale  '.^v  « * UaC  same  side  of  an  issue. 

point  that  Carnivore,  under  the" law^  -hat®™  qttestloos.  that  underscored  the 
could  be  used  withnnr  rt,  5,hr  1^"’  ;'hQt  govern  pen-register  surveillance 
telephone  wiretap  " ***  dlf£lcalt  ««  "Probable  cause-  required  In  a 

said  tLCclSton\SSt?ation  asse^t^that^'we  don't  *“”“*£  an^  scornfully 
track  of  our  own  e-mai3»  wh-i . asserts  “at  we  don't  even  know  how  to  keen 
, , e , 11  whii.e  -now  we  see  a very  soohist-ioat^d  a,.,-.*-  „„  - p 
keeping  track  of  other  people’s  e-nails ! « y ^opnisoicated  system  tor 

After  the  hearing.  House  Majority  Leader  R' chard  v 
statement  saying  member*;  of  hni-h  ^-X w K-*-Cnara  K.  Armey  rssuea  a 

administration  is  infringing^n  Are^Vn*rs?hK-ed  *stron?  «»«»»  that  the 
against  unwarranted  search  and  seizure?  ^ constitutional  protection 

Jtiv.il  these  concerns  are  addressed,"  he  concluded  - . , . 

shut  down.  “ w.*c*<.a«a,  carnivore  snouxd  be 
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a^n?:«La*Tk?r*  rip  FBX  e”mail  tracker; 

Surisillance  tool  employed  25  times 

B0DyNE:  Wliilala  Gianz;  THE  WASHINGTON  TIMES 

Ca rn!mro f ^ forcemeat  agents  say  they  have  used  the  contmTOrciai 
2 ™.SO£tWe  pro*r«  t0  e-mail  of  susp£t? asISSTTSS  past 

Su^de^9! racked  e-mail  they 

Despite  the  restraint  the  FBI  savs  it  k*« 
criticised  law  enforcement  agents  for  Privacy  rights  advocates 

ss?tei-  *tout  “• 

Carnivore  should^be  suspended  urt^V^cerr-^o^13'^'  Sai<J  yeseerday 

law  enforcement  are  reconciled,  **  0t  Privacy  advocates  and  needs  of 

Until  these  concerns  are  addresser*  r«^^fnv.rt  i , 
said,  uu  ‘>ea'  carnivore  should  be  shut  down,  ” he 

Carnivore  enables  invest iaato^s  to  nirt  ~ , 

traveling  through  an  Internet  P< flc  e”maU  messages 

monitor  who  a suspect  conta^c"^/^  provider  s computer  system  so  it  can 
4eCv  contacts  and  who  contacts  a suspect. 

Hr,  Karr  and  other  federal  officials  sa>d  ^ 

system  is  crucial  to  he  Id  the^  ke^n  in'^M  *''*  , e high-tech  surveillance 

breed  of  tech-savw  criminal  *T  an^c^uc<  *1  **«*>!  ^ncf?aSi^y  sophisticated 

. «*d  crucial  to  help  tnexn  keep  the  Internet  safe, 

baginning°toCappear  on  line  in  th®  P^ical  world  are 

Di Gregory.  ^ ' 8Axa  BsPuty  Assistant  Attorney  General  Kevin 

If  we  fail  to  make  the  Interrupt-  «- „ „ 

Internet  and  e-cosaaerce  will  decline"" ' tndaroerinoS*-h^n‘:X<3eilv ® i2  UfiinS  the 
the  information  age.  . . . Carnivo-4  9 t^e  very  befits  brought  bv 

used  on  line  only  under  narrowly  defined  -if?1*  ®n  a»v«*ti«ative  tool  that  is* 

* uct  °£  ci«*»  *>«*  **>•»*>  „„  i„ 

i he  potential  for  abuse  here  ARrtvvnn\}et  « * « 

Alabama  Republican.  ~ ' enormous,  said  ReP-  Spencer  Baehus, 

Mien  it  is  us^?°lte*eiK2^,Taf5rJ4^f^  said  Carnivore  is  a little-used  tool 

are  caught  collecting  more  da  tf ' than  al  1 Sd°’*thev  Jan  ,care£ullv'  ar“d  if  they 
five  years  for  committing  a federal  felony.  # ^ey  can  hm  ^^risoned  up  to 

P&&&t  we've  had  many  agencies  go  havond  p , , , 

authority,  * sard  Rep.  John  Conyers  Jr, , MicSS  02oc«tP  th*lr 

Mr‘  ferr  ^ FBI  and  Depapt«  «£  d-tice  will  seek  an  independent 
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review  of  Carnivore  this  year  to  show  they  aren't  misusing  the  program. 

forLS?Srn?lPriVry  ?ights  adTOcates  also  criticized  federal  official 
torus  mg  Carnivore  when  Internet  service  providers  could  -?««*■  =c 
collect,  information  being  sought.  iS  COUAd  3ust  as  easily 

„ *7^®  ought  to  be  more  control  in  the  hands  of  the  Internet  service 

providers  > said  Alan  Davidson,  a.  lawyer  with  the  District-based  civi* 
liberties  group  Center  for  Democracy  and  Technology 

Ciiat  iew  nation's  estimated  10,000  Internet  service, 

providers  Lave  tbe  rft0tHlS  to  •sift-'  jc  r * - U iservyce 

law  enforcement.  through  e-mail  traffic  and  collect  them  for 

But  Hobart  Com -He var e f an  Attorney  who  am  t ^ ~ 

service  provider  EarthLink  said  represented  Atlanta -based  Internet 

iVj-.  £ j % •»  ' «rct  M0i,  ttXink  was?  oa tberxiic?  e --tndi  1 

the  federal  government's  request  earlier  this  vea.-  wW  u „ *x  2Flt0I,n?tlon  at 
comply  with  a court  .■  >. ..  , . ■ yea*,  v. r. c . , it  was  forced  to 

computers  let  tedaral  cfficiais  install  Carnivore  on  its 


mes2gefdKrai  Co-f^f  was.*fset /hat  Earthhink  was  capturing  few  e-mail 
messuages,  Mr.  Corn -Revere  saics,  and  it  needlessly  installed  Carnivore. 

si-aaM*^^^nh'-* niberties  Union  Associate  Director  Barry  Steinbardt 

ofgf s source  ^ made  public.  The  source  code  is  the  a- 

capable  of  retrieving’  «r>he  Ac£>i  h*4  MJ''  txx  *how  Just  what  Carnivore  is 
-earnest  r ^ t .F  J s tiAeo  a freedom  of  Information  Act 

- u.jjesv  w»tii  vhe  J-Bu  to  get  the  source  code, 

? rafc  of  Questions  about  Carnivore  and  its  use 
-awmakeis  yesterday  didn't  express  any  willingness  to  make  immediate  eh^e« 
m the  federal  government's  authority  to  use  the  surveillance SSL 

“We  should  be  sensitive  to  .*r»v  nnfat.cui  „ ..  , . 

Even  a system  designed  with  the  ' belt  oflntenUons^o 

essential  law  esif or cement  f unr: t i n+i <?.  1 x carry  out. 

not  orooeriv  »onir-^S? ZtT^?nB  £?*•«■»">  f°r  concern  if  its  use  is 


not  properly  monitored, * said  RepV 
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BODY; 

SHARYL  ATTKISSON,  anchor; 


First  came  wiretapping  phones, 
cybersurveillance  program  called 
Stewart  reports. 


Wow  the  FBI  is  using  a controversial 
Carnivore  that  wiretaps  the  Internet,  dim 


JIM  STEWART  reporting: 

user-erLdathJpRT  X*V  MUf0t\e“!t!aiis  are  sem:  received  by  computer 

ou v'" ' Bu t d*- he  nrnM criminals  are  now  just  as  fond  of  them  as  the  next 

fhl  J , agentS  has  alwaY8  been;  Just  how  do  you  sort  through 
, SAbberish  to  find  any  meaningful  evidence?  The  bureau  told  Congress 
it  thinks  its  found  the  answer  in  a software  program  called  Carnivore. 

unforton«rtRrL!ARK;IKS0K  (Geaeral  Counsel,  FBI!  : This  is-. despite  its 
unfortunate  name,  uhis  as  a tool  that  xs  very  surgical. 

STEWART:  Essentially,  Carnivore  is  like  a wiretap  on  the  Web,  Phvsic&llv 
r^om  n?thin?  *°re  than  a sm&U  coaster  the  FBI  can  lock  inside’ the^witching 
internet  service  provider  like,  say,  America  Online.  But  instead 
of  jading  every  AOL  customer’s  e-mail,  it’s  designed  to  zero  in  and  record 
3ust  the  messages  sent  to  and  from  one  particular  e-mail  address. 

or  SrveilliL?^thDtMf0r'-Lab  Oirision'  PBI) : We  don,t  do  broad  searches 
surveillance  with  this  system.  That's  not  authorized  by  a court  order  and 
m my  view,  could  not  be.  v uiue‘  <sna' 

STEWART:  Critics,  however,  immediately  asked:  Who's  watching  the  watchers? 

Mr.  ALAN  DAVIDSON  (Center  for  Democracy  & Technology) : Carnivore  has  access 
knowU?tr^  xnfof,atio?  than  ifc  is  l«sr*lly  ^titled  to  collect.  How  do  we 
put  on^Carnivore?  Carnivore?  How  do  we  know  what  kind  of  leash  has  been 


b^tween^wIrisifn^S  for  the  skepticism  is  because  there's  a big  difference 
the  Internet  and  wiretapping  a telephone.  If  the  FBI  wants 

thebnLnS  Ph0nv'  ty  get  a court  order  and  SO  to  the  phone  company,  and 

the  phone  company  makes  the  connection  for  the  bureau.  If  the  FBI  wants' to 

wiretap  your  Internet  address,  they  get  a court  order  and  then  they  can  make 
the  connection  themselves.  y mak€ 

hacS^’^ndThe^  rar  alread>'*  mostly  against  Internet 

hackers,  and  the  potential  list  of  suspects  and  their  crimes  is  growing 

a! we  isaSSttKoyton%orT' tv'  thS  of  commercial  e-mail  messages 

Washington^  Ct  d &°  tOP  blllion  a Feat.  Jim  Stewart,  CBS  News, 
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HEADLINE;  FBI  ACCUSED  OF  VIOLATING  E-MAIL  PRIVACY - 

ADVOCATES  SAY  PROGRAM  SIFTS  THROUGH  EVERY  FILE  ^ENT  THRODCH  rpp,'-rrTr 

HELM  P-I  WASHINGTON  BUREAU  THROUGH  SPECIFIC  J.6PMARK 

DATELINE;  WASHINGTON 
BODY: 

advocates  and  technology  experts  yesterday  blasted  a new'  FBI 

thS  Interiiet'  sa'/in9  the  system  allows  agents  to  mnito-  e- 
mairs  of  people  who  are  not  targets  of  criminal  investigations. 

mniion/of  fn^-y0“  t0  tru?t  “3eni  with  ^supervised  access  ...  to  literally 
t Barry  Steinhardt,  associate  director  of 

the  American Civu  Liberties  Union,  told  a Rouse  subcommittee  <rZes*iaZfL 
the  system.  "For  me,  that’s  an  enormous  lean  o*  ; U v ago  t ing 

asked  to  take."  "eap  °*  taich  that  the  public  is  being 

The  e-raaxl  sniffing  system,  known  as  "Carnivore,”  allows  i»v  ^ 

Oi. facials  to  sift  a suspect's  messages  out  of  the  s<-r-«am  of  «,  • 

through  an  Internet  service  * stieam  of  aa..a  passing 

„ «>.  provider  USP) , nke  America  Online. 

-har4SSt?iled^n  ?he  IS5  nKtwork'  Carnivore  can  monitor  all  of  the  e-ail 

.Si,  a®-)  vhe  list  of  what  is  sent  to  the  actual  content  of  the  e-mail."" 

¥2?  ^he  subcommittee  on  the  Constitution  that  Carnivore  differs 
^ ^ ^cauu*y  traditional  phone  wiretaps.  With  a oh  or » mrprSv,  Zu 

must  obtain  a court  order  to  mon<  lZ"n  t P^oua  wiretap,  whe  tt>x 

* yi f n t e. w j.  -v n\ er ^ 1 on  & of  a specific  Phono,  Then 

contacts  the  phone  company,  which  installs  the  tan,  and  when 
investigation  ends,  disconnects  it.  Agents  are  not  able  to  morito^  ^ 
conversations  other  than  those  on  the  one  phone,  at0~  ai"y 

Under  the  Carnivore  svste“,  - 

^ ^ - nrst  gets  a court  order  to  use  tho 

&gt,nu>  s oo^tware  to  tap  into  the  lines  of  an  ISP  Unlike 
wlret&D  with  « f onriKe  a tiacutionar 

ll*Z~  „ C€S?  to  onlV  one  pnone,  Carnivore  has  access  to  ev*rv  me^saar* 
being  sent  along  the  ISP-s  svstesu  In  addition  the  top  ZZZ  ZZ  ZZ~?~  ?€®8a9€ 
Knowledge  of  what  the  FBI  is^ monitoring,  fc  h u°  COf^r°l  over  or 

Sachoy  president  of  XCONN,  a New  Haven , Conn, -based.  ISP  d 
Carnivore  violates  the  rights  of  ^ik<ZZZ  'Z* 

Internet  to  send  e-mail.  9"“  y ls*w~atold^g  citizen  who  uses  the 


court 

common 


the  members  of  Congress, 


ges  from  and  to  you. 


Sachs  said  the  software  used  for  Carnivore,  which  Is  secret  bH, 
other  threats  to  * J , ■ ^ . secret,  Siso  po^es 

vulnerable  to  hackers  .*  toother  problem!  hi  said,'  i^tha^the^Carnivore  al 
&L?®  service  problems  for  several  ISPs , causing  them  to  stop  or  slow'  7 

Ju^ice  department  and  FBI  of  ficials  said  they  are  simply  trvino  to 
preserve  th^ir  ability  to  mon^  t’fir  ~r<  t,3i  **  » > , , , ^ ying  to 

is  being  eroded  by  the  arowino  use  of  new  technolooios  ««rh*ld  that  ca?ability 
cell  phones  and  wireless  message  device!  technolo3^  SUch  as  ««*W>txon, 

protects  privacTfoecfS^Tr3^0^3^  a^orn6y  general < sa-i&  Carnivore  actually 
Protects  privacy  because  it  can  be  configured  to  identify  only  the  senders  and 
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machine  has  culled.  ' *'  h huroan  reviewers  £fce  onl>'  what  the 

it  s not  just  a situation  where,  us  X -if  » 

for  example,  could  broaden  the  coverage  of  the  Carnivore  4 nr „;rl,.3  agent, 
the  court,  order,  ■ DiGreaorv  said  •ln  L«-  n arid  violate 

engage  the  aid  of  technical  people  dpS  f°,  hft-  ht  wou3f  need  fco 
Internet  service  provider  * P P ' perhaps  even  technlcal  People  at  the 

Donald  Kerr,  director  of  the  FBI's  comouter  lah  divi  «■>-,„  „a  > , ,, 
used  only  when  an  ISP  cannot  oi-oiria^  • U*  r dtvisron,  sard  Carnivore  is 

order  ^nnot  Provide  the  information  requested  under  a court 

oraer.  ihe  rBi  would  prefer  to  let  ISPs  do  this  »rv  w,t-  * - l lc 

not  possible  and  in  those  cases,  we  bring  in  Carnivore, » he  said  ** 

of  Internet  surveuLS!^0^  *b°“t  What  StaRdards  «W*V  different  kinds 

Last  Monday,  the  White  House  announced  the  administration  wi 1 > n™„„ea  ’ 
legislation  to  “harmonize-  the  laws  of  wiretapoirg  as  it  tffe-t-  tw*  P 
technologies  by  which  people  communicate  - such  at  * ?he 

and  high-speed  broadband  access.  telepnone,  dial-up  modem 
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A powerful  cadre  at.  House  Republicans  today  demanded  per 

tne  plug  on  at.  controversial  e-mail  surveillance  devici  ''"Carnivore  " P 

Given  the  uproar  Carnivore  has  created  x-ns  +■?■>»  ^ ■ , 

s Sr";2rL“?:?.k«r  9°  •«“«««  in  t; 

i =,-r,v,^  - : y A*">u®’  ii,voivea  nave  been  satistactorilv  answered  » fv„ 

lawmakers  wrote  an  a sternly  worded  letter  to  Attorney  General  J^t  ' Reno 

^exf-gnandbM  ^blicsns  deluding  Majority  Leader  Dick  Army  p. 

*exas,  and  Majority  Wnxp  Tom  DeLav,  R-Teya*?  *od«v<«  i <2  Y-  * ' • 

forcing  the  Justice  Department  to' move  «-  lirLv  ^ A®,  aimea  at 

constitutional  concerns  raised  bv  ^ mL  ?r  ^e*Slng  tae 

Armey  staffer  Richard  Diamond told' 08"tt0f*“i-1  ^vice. 

a"taCh  dir?Ctly  ^ an  Internet  service  provider's  internal 
sysut*uiSf  carnivore  is  capable  of  siftincr  rh^ounh  ~ £ *v8“  !r 

messages  So  find  thw  <-Cr  lly  though  vast  quantities  of  e-mail 

order'  Jteww  ^ 1V®  specification,  of  a court 

nr^',v!  9 ltl-  m€et  chs  specific  parameters  of  a elver  ceu-t 

order  are  - according  to  the  FBI  - never  read.  s cuont. 

IntewhM Jro?Xf  that  the  F?1  is  si^ing  through  millions  of  innocent 

i%r %; V ^sers  e-mail  messages  nas  spawned  a oroundsweli  of  oDDes^tVon  b 
the  £^ce*  Conservatives  and  liberals  alike  hive  decried  the  fb?’s  u?e  o ' 
the  device,  claiming  tnat  using  the  technology  violates  ‘con«M  t,.M  ®«- if  1 

protected  privacy  rights.  v*^e^es  constitutionally  • 

"You  shouldn't  be  using  this  kind  of  {technology)  with  tM<?  t-vr>„ 
question  nanging  over  your  head, « Diamond  said.*  h type  o£ 

andTbustS0nLe5J0d^’S  le£ter  asked  *«»  «>  retire  the  device  until  -he  FBr 
ana  vustj.ce  Department  can  adequately  address  the  f "'le  *b- 

However,  Reno,  in  her  weekly  Justice’' pi ivacj,  concerns  iv  raises, 

not  suspend  use  of  the device J££? aKr  2 **i&  she  woyld 
is  completed.  ~ atter  an  eternal  FBI  review  of  Carnivore 

-W.SEa^.£jir^,ri^  “scs»*ra  -?« «* 

t.  in  tSha;£Slit  SMSS 

JusS/Lpa"^^?'^1  IiSl?7cJ?niSrSf1Ss°^“SHtioS“a  ”aiC  £“  tfce 

KBAS? 

The  Justice  Department  was  not  available  for  comment  on  today's  latter. 
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BODY: 

far  -feared  Internet  privacy  legislation  probably  won't 

fr  th^B  congressional  session,  lawmakers  ° L go  ver^ 

thorny  issue  and  will  ideally  be  ready  to  dL-lon  "r~2?h?^  «SK  X”  -he 
year,  Sen.  Patrick  Leahy,  D-vt.,  tol/r^“  ^ ? substantive  next 

leaders  today*  v nigh-  v.ech  i nous  try 

*X  don't  think  anything  will  be  don**  *.v> 

adding  that  Congress  should  fceoin forking  £,  5^Jear\  Lefhy  said' 

tederal  privacy  standards  next'Vear  **rf >on  se^tin3'  baseline 
has  a chance  to  die  down  the  Presidential  election  brouhaha 

Despite  the  difficulty  of  establishing  arrive  . , 

this  Congress , Leahy  blasted  the  notio "hf  y -egtsiation  in 
congressional ly  appointed  panel,  " " ^ - wbe  privacy  issue  to  a 

^n;if.r?’Ve  SOt  $*?•  to  ^vestig&te  the  investigation  o'  <rh,f(r 
Administration  scandals)  we  ought  to  at  . • Clinton 

real -world"  on  privacy,  Leahy  said-  “*““t  *“*'uQ  '■**e  time  fco  do  something 

7nXfndX5  Kouse  legislation  would  establish  a comiss < on  *o  de"ir» 

Internet  privacy  issue,  u-i>-S4'on  v-°  a«^re  into  the 

Although  industry  leaders  remain  lee^v  of  f„x  , - 

privacy  standards  without  a fioht  f ” Pvl  S • ! A Internet 
willingness  to  at  least  di*cu^  a' i **?-£*?'"***  °<Tunity‘*  growing 
way  to  enacting  privacy  legislation,  “heahy  laid^^  Shoula  nelp  clear  the 

Business  S^f  Sa??All  trieet:if?  on  Capitol  Hill  where  the 

BSA,  which  represents  a slew  ofiarSe^oftwLr^Ler^^''  C^pion  **»«*■" 

whfsupmS^Xe'!^  C^r  Chafflpion  statuettes*  to  ia^aakeS^Sf 

A*4°  suppor"  intellectual  property  and  anti-piracy  causes  *<=0ul«tors 

In  addition  to  his  work  m the  » v-o^ & * . . 

combating  software  piracy  and  supporting  the  re^ aration  o?  ul^  kfY  roles  in 
on  encryption  products.  SSA  leaders  said  that  ™ f export  CORtroIs 

thank  him  for  his  work  in  those  areas  Y S Leahy  Che  award  to 

whiff  Jhf sofSLrfndulLf llfnof f ^bert  Koileyman  told  Newsbytes  that 
privacy  standards?  the  gSp  wo Cfeaticn  oY  federal 
with  Leahy  and  his  colleagues  next  year?  C discussing  limitea  legislation 

S«?cS  5i;bSc,uSte8l"a 

legislation  would  preempt  harsher  state  and  local  measures 

Still,  BSA  wants  Congress  to  give  industry  self -regulation  a chance  and 
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tasted811  reR>ainS  concerned  that  any  privacy  bill  nay  go  too  far  for  his 

HoillShsaidmiSht  SSt  8CSrted  in  that  process  thac  becomes  a snowball, « 

today,  Leahy  also  addressed  "Carnivora* 0 the  FBI  * s 
controversial  e-mail  surveillance  device.  0 1 don  * t think  we  rtMr>rt 
adequate  oversight  on  Carnivore,*  Leahy  sail  9 
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HEADLINE : Wiretapping  in  Cyberspace 
BODY: 

frem^Hv8 nOW  X?e  on  to  th8  internet  as  naturally  and  as 
frequently  as  thev  pick  up  a pnone.  Technology  has  created  « < 

personal  dedications,  but  technology  is  aSo K pLsfble  Sr 

b^fo^e?^eSorr2rf?10yerS  Vyonitor  Private  conversation!  as  never 
^fv!cy.  WS  *USt  b®  updated  to  *******  these  new  challenges  to 

u&sl  week  the  White  House  proposed  some  limited  chances  to  ^be 
wiretap  end  electronic  privacy  laws  that  world 

government  int^ceofcin^ « ^ * LiT  e ^ raise  standards  for 

^ . Separately , several  lawmakers  int  roduced 

etT*oyers  to  ^^ify  employees  about  how  e-4ail 
In.e^e*.  use  «,ta  pnone  cans  are  monitored.  Employees  of  The  %w 
Company  are  already  notified  ^ u\  ine  -tmes 

. i **  ■>  Uidi.  i,ne  company  reserves  t he  r-irthh 

mail  raess&aes  while  invest icati-u-v  *>  v l - ignt  lo  * e\  i ew  **- 

v s ■ — * a ^Ox«pj,3int  t Last  veax*  tne  coros’iv  ^■s  (im*  <? ^ 

^ employees  — most  based  at  a reaional  X*%7Z-  company • dismiss eo. 

offensive  e-mail  messages.  ‘ ^ A ^w.uess  otfice  — for  sending 

Xn  absence  of  more  stringent  controls,  law  erifovcesnen* 

£0  conduct  wholesale  monitoring  of  digital  written 

& us  ?lcf  rf  ‘tww* « 

> 7 , ' * * v*  ■*  scan,  r6»u  and  recorc  mill  ion??  n*  o^at  Af  „ 

“aii  on  the  network  of  an  Internet  service  provider.  Until  mw  hh  vTL  % 
power  and  its  potential  for  abuse  were  not  so  readily  available. " * : 

Current  wiretapping  laws  -were  not  drafted  with  thi ® . . « , 

need  to  be  updated.  Various  tt,w  ' * ^ ^ 'k  teCx^o^ogy  ^.n  i»ind  and 

secret  interception  of  domes^f  co^uni^^L-  tfeFent  1^al  standards  for  the 
depend* no  on  Www  *v  . c^-*ntumcatxO.^&  by  iaw  enforcement  agencies, 

depending  on  whether  the  communication  is  by  telephone,  e-mail  or  cable  Modern. 

Its  plan  would  bring  the  standards  ufed  for to terceptina  Tm  i eS  ' 

^tercent^n'  T™  p*f8ct*v®  ievel  *»*  «PPHed  to  telephone  wireSs^rllLa? 
case  nofi??H  resulc  *«  suppression  of  the  evidence  is  tb! 

^r^tS^^l^SdSdf?!.0?  PhT  CaUt  The  proposal  would  also tK 
r zi^ff  tnv  Same  .egai  stanoards  chat,  apply  to  phone  calls  for  interceoMon  nf 

Protection  bdbCabte  ^T3'  which  ^ a greater  degree  of  privacy  P 1 

protection  under  a law  that  governs  cable  systems,  1 * 

administration  is  also  calling  for  greater  authority  for  court*  *•<> 

onncomiL^n^ooLr^?^8  ‘Ca  ?**  de^ces  that  recor/the  phone  numbers 
mil  messages  S ^ CaliS  aRd  tD  track  the  ana  destinations  of V 

These  changes  are  clearly  needed.  But  Conaress  also  needs  to  nm,.; 
safeguards  aoainst  the  goverreoent  < a wr<-.«vrf.-l  "»oo  S°  r*eecis  to  Provide  nev; 
s'wl-j  i j »« . , r ^vbuubw  s wrongful  use  of  ever  more  cower ful 

surveillance  technology  against  law-abiding  citizens  , 

been  »Knnt-  t y witxzens,  serious  concerns  have 

sed  about  Carnivore,  the  new  online  wiretap  system  used  by  the  F.B.I. 


7>od. 
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to  track  the  communications  of  individuals  suspected  of  criminal  activity. 

inv2t ioati on  ^ 2®  teC!moiog^  ca5?  iBDlate  the  e-mail  of  the  target  of  an 

2^ice9p2videf  aivLSSrm'«WTen  h?°^  F t0  the  network  o£  Internet 
i v ,,  provider*  gives  the  F.B.I,  unlimited  access  to  the  e-ma'  1 a f *,n 

subscribers  on  the  network.  While  a court  order  is  still  required  to  in2™* 

°£ .messages,  the  secret  technology  controlled  exclusively  by  la^'’ 
enforcement  raises  fears  of  improper  monitoring.  ' Dy  ia* 

£oat£ne  government  surveillance  of  private  conversations  was 
feasfble^to  eateL^aC?1Cf i?:^  a?,by  le^al  constraints.  Now  that  it  is 
be  2renotLnS  rf  eIectro“cally  °n  an  unlimited  scale,  the  laws  have  to 

because  technology  °*  ^ CO“icStions  ™iy 
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introduces  bill  to  update  wiretap  law=: 

BsLXKc;  CHARLES  T.  CANADY  , REPRESENTATIVE  , HOUSE 

BODY;  For  immediate  Release  Julv  2?  2eon  „ 

Update  Wiretap  laws  E-Mails  r . ep*  canaay  produces  Bill  to 

Covered  WASHINGTON,  D.  C.  ~ R«o  *;oirs!M mirations  Would  Be 

House  Judiciary  Subcommittee*  on '►he Const  ' Cha,irman  °f  the 

Electronic  Communications  Privacy tcfo" "h.  k ^ introduced  the 
federal  wiretap  laws  to  cover  e-mail  and  stc^d'electronic  the 

wetl  as  provioe  special  requirements  for  <30 e ®,tlORS'  ** 
addresses.  Canadv  is  .Trv>n»a  k„  J'-?ovein"'cn.t  tx«cing  of  e-mail 


rights  of  Americans.*  Earlier  *1**  protect  the  privacy 

Subcommittee  hearing  on  Fourth  ?ep‘  t“cnady  cnaired  a Constitution 

■IT  program.  The  FBI^esi^S  r*iSe?  b?  the  FBI‘S  ’Carnivore 

collect  communications  that  arTthe  sub^ect'tf  ilv^ui  inte£cept  and 

14th  hearing  featured  witnesses  f™  C,*,  J‘dv*-Ul  c?«?t  orders.  The  duly 

organizations,  privacy  organizations  and  hpre^e^a  Jvee^*  rrbsrty 
r~S^o^  !“-Y  The  Electronic  Co™icaSoni  PriCa^  Act  o TIT4\ 

^Cvions.  The  first  section  abends  the  cv!i  * ot  2000  has 

also  exclude  from  use  as  evidence  in  * ° X exclusionary  rule"  to 

commur  * ca  M nn <14  „ n ^ , ‘ ^ iy  4. nterceprea  K electronic 

^w^ca^vns  <*nd  illegally  obtained  "stored  . 

®^£eq  eieectorue  communications . * 

i he  ho.  11  simply  adds  electronic  comrnm's s «*■ -i .-*%* ^ ^ * 

cove™1  r“ic^tioRS'  The  second  section  of  ’ the  Mll^Sw^theT^3  '1r® 
government  to  produce  annual  reports  recardinc  i?„  fcl?«  federal 

?den*7^L°f  >’t0red  communicI?ioL!«  Thifr^L^s  the 

..den-rea-i  disclosure  requirements  the.  L_~  s ^rtaany 


vuau,  it  a pen  register  or  ^ . 7 

Sat^ecfis^a  2?isssi  r 

been,  is  being,  or  will  be\oj®dtted,  ‘S^SfoLat^on*’ ®>Satta  vri*t  *** 
such  installation  and  use  fof  a r.o„  „ ormat^on  x~kely  to  be  obtained  by 

relevant  to  an  investiStiin  CI  that  er  me^  rLT^f  <***»  is 

legislation  (Tpagea)  please  call  MicheUe  ^noS  at  )&%-?? ’* 
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It  s iror.u  Chat  the  company  the  Justice  Department  Wnt-w  „„  , , 

up  is  crumhl  ina  cookies  wh * 1 ^ ^v>^  «Atro^*A  V < ax  cmrnc  worked  so  hard  to  oreak 

government  is  eating  raw  meat. 

Cookies,  as  ra&ny  computer  users  know  are  fcnf-e:  nf  *,  - .. 

keep  track  of  visitors,  rn  addition  to  inn^r«^®f  code  that  help  Web  sites 

exploited  by  hucksters  to  learn  consumers  - interest s' andtabit^^ti^t  v 
knowledge.  They're  an  immeasurable  source  ofpSoSi ^inforStion  *** 

So,  it  was  welcome  news  recently  when 
software  to  allow  the  individual  user  to  block  ®^PS*nced  new 

little  tastes  of  their  private  lives.  c AOm  or  ai-  °u  th®««  tempting 


IS  month?  ffwf  ab?ut  the  same  time  was  the  FBI’s  revelation  that-  fo-  t-h* 
j.8  months  has  »een  using  a comouter  nrn™i  „ : , , ...  . tnai,  i.o^  t.»e  past 

installed  on  the  network  of  ar  ria^natPivr^  cai1®^  Carnivore,  which  when 

messages.  The  potential  for  mischief  ~ak!s' ^cookfe?a?r>?^-?iIIi°nS>.<?f  ®~'Eiiail 
Grandma’s  oven,  * coox^e»  seem  like  something  from 

cousin  to  wiretapping  is  necessary,  the  FRt  sav-  tr 
arug  dealer  a and  other  criminals. 

ihc  question  is,  how  do  we  make  ^ ^ , 

cybercorrespondence  from  actual  or  probable  crook^a-d thjrou*h 
innocent  citizens,  members  of  unpopular  o^'m  < *'h®  e7*llea  oi 

in  power?  ^ . gr^  ups  or  j^o^ticax  enemies  of  someone 


missing  fund-raising  “pSS^  ^ 

A major  sticking  point  is  the  decree  of  «av  t-hat  _v.  . , 

standing  m for  their  customers,  would  have  Cllar^  providers, 

monitor  e-mail  traffic,  with  court  Permission  ™ if  4 ?Bx  ”oafd  P?efer  to 

filtration.  Privacy  otouds  , **  , * i^s  own  terms  with  its  own 

feds  obtain  ~ sroup»  <*j.a  &onve  or  the  providers  suggest  instead  that-  *-h» 

J.ea„  ®.ain  « court  order  a ski  no  the  cotsoan « e-s  =--,^7  iT  1?  u*at  aie 
case-by-cas©  basis.  *"  * vn"e^  jL01  specific  material  on  a 

hobbiriL*SSr«i“;y“y^“|  S«S“rth?°reShSJiiy™f^”e'~“ia  “oc 

3l?1Sr^23S.<S2S  i"““  “« « *SF!2£g,mS?£Z  SLX, 

Reprinted  from  the  Indianapolis  star. 
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???inS  t2  P?rman?nt:iy  Pyl1  the  plug  on  the  FBI's  controversial  e-msiT 

devroe,  Carnivore,  Rep.  Bob  Barr,  R-Ga . , on  Thursdav  'introtod 
legislation  that  would  curtail  Isw  ^ ^ 

of  Internet  users.  ^to.cers  rights  to  monitor  the  activity 

..  promised  earlier  this  week,  Barr  introduced  the  Digital  Privacy  Act 

?ech?o>oo^f3  updates  federal  wiretapping  laws  to  "bring  them  in  line  with 
technological . oevelopnents  such  as  the  Internet,  wireless  phones  a£T 
electronic  mail# " Barr's  otfice  said  in  a statement  today, 

W»«.  legislation  would  prevent  the  FBI  and  other  law  enforce-* 
™ , v f58  * . *»<^iduals « computer  files  unless  "factual  evidence  & 

reasonably  indicates  that  a crime  has  been,  is  being  or  will  be  co^itted. " 

f„_  electronic  evidence  illegally  obtained  by  law  enforcers  -would  be  barred 
troa  use  in  court  under  the  legislation,  0!iata 

wMSrrw®i^isXa.hc!?.  isv  t.h®  ,i®tesc  ar4  ®ost  tangible  attack  on  Carnivore, 
public  earlierRthisVmonth!°aa"  *88<3  criCiCiS®  SXRC«  news  of  iCs  us«  was  made 

Designed  to  attach  directly  to  an  Internet  service  provider's  internal 
£®rRXVRr«  33  capable  of  sifting  through  vast  quantities  of  e-mail 
messages  to  Una  u>iose  that  meet  investigative  sr?er{ floats  ons  of  - rot'rf 
order.  Messages  that  don't  meet  the  specific  parametex4  of  a oiven  ™ 
order  - according  to  the  FBI  - are  never  read  S lL 

that  th®  FF  iS  si£tinS  through  millions  of  innocent 
the  devicet^onservative^an^iiberals^aTike^av^decried  SfiSFZiS 
;Stectef;rfi™rUtr:  ^ ***  teChnolo9y  violates  constitutionally- 

Bair  s l€0i$lstion/  til©  PBX  would  rot*  v 

»«»“!>*=  of  InMct  «1.»  » SSShrf  SiS»l“vSic«  ah  the 

v„„0!C^Of^CainXv?fe>S^f°?t  ar<5ent  Congressional  opponents,  Barr  on  Thursday 
*&a  o-»e  o-.  more  --ban  *5  lawmakers  who  signed  a letter  to  Attorney  General  * 
Janet.  Reno  demand  inn'  & ► wn6ra.i 


Janet  Reno  demanding  ZCZ  ZZ"  Z Attorney  General 

;anec  x.eno  aemaudxng  ^hat  tne  FB^.  shelve  the  device  until  the 

issues  surrounding  its  use  are  resolved.  ' ' ^Of*&«tuv,ionaj 

«n  r^L5be  Upf°a5  Carnivore  has  created,  and  the  potential  impact  repo-tn 
on  carnivore  coulo  have  on  consumer  confidence  in  the  Internet  we  urap"  v-*n 
to  suspeno  any  activity  involving  the  development  or  use  of  Carnivore  until 

2lSSS^SS!*ey  ““**  UTOlwa  fc*Ve  b*“  answered,-  S 

leaf «i ^ hfr‘s!:rin9ir13  unchecked  e-mail  surveillance,  Barr's 
egxslation  would  also  prevent  law  enforcers  from  tracking  the  movements  of 
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BODY ; 

shelwilflorsuSnendYhf  ^;?ey  *****  *«no  said  Thursday 

people’s  e-mail  while V'theria':%ofoic^e^°^M^ni^0rinG  °f  some 
at  the  Justice  Department  “ S S ^ /^?ra"  18  under  review 
use  i*-.  a,rfm  mT„  -*  ?nxriK  Lhat  {FBI>  agents  can  still 

r •<?ur:n?  <-h®  review  or  the  FBI's  new  "Carnivore-’  We» 

Reno  said  at  her  weekly  news  briefing.  -=rs.eI1!( 

Reno  said  it  is  TV~  v . 

process  and  address  the' issues  ra  rd-- 1 Sf1*1”  the 

experts  and  others.”  she  said  she ' h^e  * ve  V ?ft  * , Privacy 

•"  ri  : *>cv©^  we  will  foe  able  to 

“CjaiwSS  "h*»*  issues  in  a thoughtful  way  and  resolve  them." 

Reno > s comments  came  amid  a hyi^a  , * 

harden  on  ffeder-i  i H v ^4jt  co  increase  the 

^ * enforcement  agencies  to  justify 

and  other  communications  * " 4 -^  -o^iruj. 
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One  provision  of  the  legislation  that  is  similar  to  * 
proposal  by  Sen.  Patrick  Leahy,  B-VT,  would  give  indues" 
orscretron  over  whether  or  not  to  authorize  wiretaps?' 

Currently, 

3 udges  must  approve  such  reouests  so  i ~ > * 

officer  swears  that  it  "i«  releva®r  V W enrorC8rr>ent 

*5  *•«*«= 'ant  to  an  ongoing  investigation. 

Another  provision  of  the  bill  would  overrule  a 

last  year  by  federal  Communicaf  i ons 
commission  and  would  stop  the  government  from  tracking  the 

£t*eXHoutl  rtr--?'“ne  ?*®r?  without  a court  order  . “As  'the 
'*°Ub«  reentry  acknowledged,  our  wiretapping  laws  have 
«Sr  ^hind  Che  technological  explosion  of  the  past 

^ a.£?n8er  CIA  89ent  and  f«*«ral  prosecutor. 

Priv*c*  hct  corrects  some  of  the  most  glarino 
coi.t,rad).Cvions  ano  loopholes  in  current  ]aw. 

As  systems  from  NSA‘s  Echelon  spy  project  to  FBI'-' 

sv»-veT?f?r>^Ve  pfove”'  technological  advances  make  large-scale 
Sw^vei fiance  easier  tmm  ever  before.  It  is  vital  a 

our  civil  liberties  by  making  certain  the"Lw t|Tewn‘ 
8arrSslidinS  F°UrCb  AJRendsnent  Protections  from  being  eroded,* 
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HEADLINE:  BARR  BILL  UPDATES  WIRETAP  LAWS 
BYLINE:  BOB  BARR  , REPRESENTATIVE  , SENATE 

S^~s»f53g  r* 

tS;S  IS  o?  So  h«  rs  *“«**‘«*  «*;'  Wt ,i 

privacy  ptoMctioi»'«a trlS  JhS'fn  ?fff“ t”  SKS,  T,“  f*“'* 

oucb  m th.  lPMcr.cc,  wireleL  phone.,  Sa  eui‘c«lfe  Sil?“  <Jdvelow““' 

enforcement  to  reoort  on  its  interc«LlL ?tauie&  i«Wiring  raw 
addition  to  «-h*  ^ .nw,'',^  j-ritv.wpyton  vt  electronic  communications,  in 
, cl  or.  co  v.ie  te-tapnone  wiretap  reports  already  yecnb  red  > 
electronic  evidence  in  court  -if  U i I.  ^kp...  • I *tq,  I e 3j-oc"  the  use  of 
government  access  to  thelderPrieTof  liJ-e9aj-AY-  > Stop  unchecked 

reasonable  evidence  a crime  has”b*l~  coaw^^ed^  ^>**s  there  is 

tracking  the  location  of  celV  ts^T , &top  the  government  from 

probable  cause  « As  the Sus*  ordei‘  baseq 

laws  have  fall en  far  behind  the  °^r  wir®tapping 

For  example,  under  current  law,  e-ma^s  *eceW  !e*s  ?eeoi  uhepa®*-  dsc«d«- 
both  traditional  -Z*  “yce"ve  less  legal  protection  than 

rs:  raoii  case*  telephone  conversations  * ^ KJTVu„ 

Digital  Privacy  Act  corrects  scjm*  of  the  \ - B x'  7he 

loooholM  in  h or  ii3°st  glaring  eon tracuet ions  and 

cS?SS  IL4  railA  -wct?yst"f  h°“  "“•*  ProJ*ct  »*oi«  to  fbim 

p.A.rito u°ssi  jfssLr*  t?'3"  .*«•}• 

making  certain  the  iawVh»fces  *e  i..,,.!1  ~a_d  out  csaix  liberties  by 

protections  from  being  eroded  »«  , !h  ^ E l^T  I”1  r*9  Pourth  ^^ament 
Tnr^f*i  r'vs^  ■ *. , “ cieci/  8a ^ * continued , Barr , a Mesaber  o f tha 

uJdic^aiy  Com^uttee,  has  served  with  both  n,wnrawo^*.  ~ HOwse 

Central  Intelligence  Agency,  1 u^pa roaent  o*.  uusuice  ana  the 
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HEADLINE:  Soaring  online  warrants  worry  privacy  advocates 
BVLINE:  By  Will  Rodger,  USA  Today, com. 


”Ptoer  of  search  warrants  seeking  citizens'  online  data  has  soared 
during  the  past  few  years,  a USA  Today.com  study  shows,  ' soared 

nation' fw  an  «»»ination  of  search  warrants  served  on  the 

& ^argest  Internet  service  orovi der  Mori, — . 
surprise  to  federal  lackers  mid  cl^I ^ as.a 

for  legal  reforms'.  * ^ ns  ana  are  prompting  calls 

800  percent  jump 

Tne  warrants  , served  hv  starp  i,v^i  4 
nation  . * , u ~oc<ui.  investigators  troxa  across  the 

su^rrih^^  discovering  the  identity  and  activities  of  A0L 

eou-t  S A0L  J**  served  with  33  search  warrants,  according  to 

167‘inhfo8W«Rd ' *5^4  %'  ■ Wh*re  A0^  is  based-  That  number  jumoed  to 

throuS'julJ^liSriogJ  show!  lovas£i»ato«  had  warrants  on  AOL 

examine  legal  standards  applied’^  LteJn^  invesV iaatiS^V S&1°-  Y wiU 

House  Majority  Leader  Dick  Armey  Cm™  4Vd  ®o? atlonsl  At  * 

whan  sn/tA  . *vk*ittsy,  k iexas,  said  police  need  to  tell  Conar*»<s^ 

wt,en , why  and  how  they  perform  electronic  searches.  ^u-rLS!3 

a 1 1 4 44  & 4 4 kuhw5?  because  they  believe  that  electronic  surveillance  o* 

43hly  yo’:ferf'4  tool  that,  if  not  tightly  controlled  4el44 
*'**es  against  unreasonable  police  searches.  ^ v-oiat.es 

*SJe  do  have  reports  on  wiretaps,  1 Armev  said  *ww  «w».i  , 

S^'iSS.’’" th*  *•  1,  ™ SoSihoSKi™  * 

w*“i' tMBSS'1;Lot”tS  pbi ■ rsc”at“^?  ‘amSKV 

device.  Some  say  the  FBI  mav  be  inte-'-ceo^ina  *<-nn  ™,iI  te‘n^  w-r* tapping 

”*»  -«*»“  «ui  i»  t™Jt  “SoS""1  ““n  “ tties  “ 

»itr?hriSi^™rS^“l,S;h“Klf.ot£lcla?,w««'>i»9'<>B  «M>  itself 
icnorina  anwhar  016  s.reax"tlroe  interception,  it  is 

orot^tf  aft44e|4geS  haVe  ^en  delivered  hae'oS?  a fraction  of  [4  “ 
protections  afforded  an  ordinary  telephone  call  or  e-mail  still  in  transit. 

Searches  for  online  data  typicsllv  involve  . ~ ,,  + . 

and  child  pornography  to  violent  crime  and  fraud8  5 '"T<m  harassn*nt 
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wmil Chief  Of  staff  John  Podesta  has  pledged  the 
would  move  soon  to  protect  electronic  data. 


aomnxstr&tion 


extent  to  which  our  electronic  cor^soondene*'  d'  considering  the 

fnd. information,  shouldn't"  !hW  coLt?  af ^ 

Justice)  Louis  Brandeis  foreshadniWf  „„„  oup. erne  Court 

and  effects  mentioned  in  the  Pourth^endment?*  **  *****  **  th®  P&pers 

FBI  downplays  concerns 

.B/otte”oSgi  JSo^rigJ^S'cSfrS Jui T”*”  ““  f°”d 

call.  confidential  as  a personal  telephone 

Kf?  i?id  “*  »« 

sSaj^rss.  «••*«.  '««*  »»  sgegii‘gjrieh»1,fi?gdr“sg 

search  wanant.  ’What  about  records  of  mv  tr«i*nrH».  lS3I®iS 

•I  can  gu  that  with  a subpoena  (ran,  gi.nd  ° ba,“'  *’<’  “*«• 

l«fSor^S^.f^I°0k5W  *?.«"  ’**»  W «•».  !'■«  insran™  tN 

subscriber  identity  ‘^teQ  ^formation  from  AOL,  such  as 

*UKkiwA-^  oxi^^ng  cats  and  payment  history. 


To  comply  with  the  more  extensive  orders,  cherts  *»v  i«r  . , 

a great  deal , ' "'vrs  **“>  * mus  t hand  over 

They  can  get  all  information  * MarV  £ ._ 

prosecutor  and  vice  president  for  cvber  law  a^?ob«l 

get  your  credit  card  data  and  eveVn;nh,  v f „ric  4 Inv.egtity.  They  can 
a record  of  what  times  you  dialed' Ln  where  vou  th  them.  They  can  get 

were  online,  what  activities  vou  were  enoaoed  !w  ZtJZ<^‘  flow  i0ng  you 
what  chat  sessions  you  were  in  and  what  ySu  Sil'there  • ®iC*S  y°U  visited' 

onlSe^ut  llfvarrSaUy  ^erythin«  their  «"***»«»  do 

roay  keep  e-mail  for  two  years  or  mo  4'  policies.  Some  ISPs 

weeks . And  that  will  aff^t  auth^ities-  ?£ter  a few 

criminal  investigations.  ” to  get  wnafc  they  want  in 

For  instance,  he  said,  companies  that  host  Web  sites  nf‘im  « 

the  numeric  Internet  addressed  that  hhiw  cf  oUen  keep  records  of 

vicitnr's  tod  „ , ,cnat  hit  i-heir  sites  for  veers,  vet  onlv  th  » 

wsitor  s ISP  can  disclose  which  subscriber  is  behind  that  number 

America  Online  spokesman  Nicholas  Graham  said  the  cormanv  ha  a „ 

on  law  enforcement’s  growing  interest  in  subscriber  records.  comment 
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HEADLINE;  Wiretapping  in  Cyberspace 
BYLINE;  New  York  Times  Service 
BODY; 

Millions  of  people  now  log  on  to  the  Interne*-  as  naniraiiv  ^ r „ 

yp  t phone-  technology  has  cS',  revolution i r i ly 
CQiuiuuni. ca t ions but  techno! ooy  is  • 1 1 * **  P^*»onal 

even  employers  to  monitor ■ i It'  ~ 1 w P°s^ible  for  government  and 

i ^ z 1 , w°«a^oi  private  conversations  as  never  before 

era  laws  must  be  updated  to  address  these  new  challenges  to  privacj 

wireta?5idWSLSon*fn^^fe’P^?^  sotse  Umifced  changas  to  theU.S. 

goverm8ntaintercention*>o*Ve-ni'><*WSe-^t-If0?^<^  rais*  Ie3al  standards  for 
legislation  *-#>  *" - ~ "!kl  J' A ' ^e^aratexy,  several  lawmakersintroduced 

use  and  "phone^calls  are*^nitoredf  ° ”0tify  “«>loyees  ^outhow  e-mail  /'internet 
res«^s°th?ri^hthtoK^y«w-3anVo-s-^e  *lpf®dY  aotified  that  the  company 

55* « 2&SLS1,1 

Du;?  4.  ness  oil  ice  — „ au  “ #,egj,onai 

xU‘  oi.  tensive  e-mail  mesa  ages  , 

«a*3  ??"“  2oiSi“£S£rtS^;«S 

provider.  Until  now  this  k<nd  r>*  tl  rr*-  . 0i.aa  Internet  service 

readily  available  *'vw  ^ p- ^ « >±Q-  x t. s potential  for  abuse  were  not  so 

mindCandeneed'fo  ~A*f  were  not  drafted  with  this  technology  in 

standards'  for  the  secret  erew^on^f  S€t  different  M ' 

enforcement  agencies deoeodf™ ™ £ ?£  d™txc  communications  by  law 
e-mail  or  cabff^dm.  I^  CUnton  communication  is  by  telephone, 

these  inconsistencies  ti-c  ^SC  f5  n xs  Proposing  to  eliminate 

] n t or r enr  < mT«  7 1 L Px0n  would  bring  the  standards  used  for 

^icercepuxng  e-mail  messages  uo  to  th&  7 f 

applied  to  telephone  wiretaps ' il?ecrai  /r°: ^vel  now 

suppression  of  the  evidence  as  if  the  list  w ^h° i T^1  ■' woald  resuit  ia 
phone  calls.  ' s n case  *'ov*  With  illegal  interception  of 

review6] is  Aiso  calling£or  greater  authority  for  court*  to 
review  law  enforcement  requests  to  use  device  rha?  uouics  to 

of  incoming  and  outgoing  rails  and  to  track-  rtc  ;!■  ^eeoia  the  phone  numbers 
mail  messages . trac*  the  ori9ms  and  destinations  of  e- 

These  changes  are  clearly  needed.  Hut  Congress  also  need**  — - 

safeguards  against  the  government  ‘ s wrongful  use  of  ever  more  oowe^fot^  nSW 
surveillance  technology  against  law-abiding  citLens  P°Wer-fuI  u 

been  raised  about  Carnivore  the  c;clJens*  Se^rous  concerns  have 

track  the  communications  of ' individuals  suspecte^of^rimT  T*  ^ ?h*  m to 
system,  when  hooked  up  to  the  network  of "»-££*?«►  of  cnminal  activity.  The 
the  prt  k . e network  of  the  Internet  service  provider  nivor 

the  FBI  unlimited  access  to  the  e-mail  of  all  subscribers  ™X  ! ► '^9 

While  a court  order  is  sHii  ™,i„j  *.«  • t auoscrioers  on  the  network, 
the  e;f=*r-v-Af'  t- rorrv.i-i.'s i ~ ko  intercept  the  content  of  messages 

the  secret  technology  controlled  exclusively  by  law  enforcement  raises 
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of  improper  monitoring. 

now,  routine  government  surveillance  of  private  cowe*>sat<o«i« 
limited  as  much  by  practicality  as  by  Wal  ■ s 

feasible  to  ea y con^uainti>,  Now  that  it  is 

be  strengthened  to*prevent  moni to~ina°of ^ “n'kl?*'te<s  scei®'  th®  laws  have  to 
because  technology  Ss  it  easy  9 8l"  onlln®  c™nicaticns  simply 
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has  been  and  ij 


v This  SOW  will  incorporate 

?nnn  ' tasklng  and  taskin9  modifications  for  the  current 
2000  contract  J-F8I~G0-O80.  ^ c 

IX.  (U)  PROJECT  DESCRIPTION  BE  TASKING  AREAS 


,he  ■■  tasking  {Tasking  numbers  are  referenced  to 

-n^  original  contract  tasks} : • 

— — j-iHi — Area  Summary  Table 

TASKING  AREA  , TASK  DESCRIPTION 


RENAMING  TASK 


I TASK I KG 


DRAGO 


u^A^Oh &T  - High  Speed  Intercept  Study 
Technical  Threat  Analysis  Program  - Data  Base  suppoi 


(U) 

Sections 

III 

desc 

ript 

ion  ox  the 

ta 

III . 

(U) 

TASKING  2 

.8 
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This  task 

has 

XV 
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TASKING  2 

.14 

iq  for  FY2000. 


give  a more  detail* 


VIKING  ENHANCEMENTS . 

■Masking  * 
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(U)  TASKING  AREA  #4.4  HIGH-SPEED  INTERCEPT  STUDY 


provide  the  DRAGON ET  program  with  a 
l for  Internet  data  intercept'3  on  The 

nvlr^ft0r  fhaXhRiak\enhance®e^ts  to  existing  Carnivore  intercept  drive 
svstem  throughput  performance.  These  enhancements  will  mak€ 
operating  system  performance  enhancements  to  include  service  pack  1 ! 
additional  capability  that  will  be  added  in  addition  to  overall  thrc 
Carnivore  to  filter  on  PPP  streams  and  the  update  of  the  graphical 
filter  associated  with  PPP. 


use 

with 

ughp 

ser 


VII.  {0>  THREAT  ANALYSIS  PROGRAM 
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, ^ fne  contractor  shall  provide  software  upgrade 

installation  support  and  software  maintenance  support  for  the 
Technical  Threat  Analysis  database  and  the  Special  Projects 
database.  The  contractor  shall  supply  a software  enaineer,  with 
an  anticipated  minimum  level  of  EL-4,  to  support  this  effort  at’ a 
rat 6 or  ewe n t y f i ve  {25}  hou rs  pe r mon t h , 


VIII  > (U)  LOCATION  OF  WORK 


ey  them,  FBI  reserves  the 

t & C X I JL  tf.  1 S S S h oi  i 1 d A FAn  t'  i n 


ouics  a contingency  arise. 


gat  to  approve  any  such  external 


IX.  (U)  GOVERNMENT  FURNISHED  EQUIPMENT 


csocumeritation  and  addi 
identified  hv  thA  rrmi- 


"Vs u,:Vi! \ 4 1 x A r u rn A sh  na rdwa re , appl i cable 
no  additional  GFE  requirements  that  should  be 
he  contractor  in  his  proposals. 


X.  (O')  PROGRAM  MANAGEMENT 

pbt  • « f!L!if0vi5e  managerial  and  administrative  support  for  the 
bcneouimg,  task  assignments  and  budgets  shall 
^ 9®^® rated.  Monthly  status  reports  and  other  relevant  FBI 

(PM0)  document®tion  shall  be  generated 
t *’u pP lxed  to  the  FBI  Contracting  Officer’s  Technical 

Representative  (COTR)  at  required  intervals.  These  reports  are 
"-°  delude  monthly  progress  during  the  previous  period  and 

irfoSJ^fr0greS?  ?r  the  f°iiowi^  monthly  period.  Budgeting 
Sf  ™ i"C,Tfn?  e*P*n"turas  to  date  is  to  be  provided 'to 

“ on  3 oasis.  As  part  of  the  contractors  program 

management  responsibilities,  the  contractor  shall  inform* the" 

- s wontracting  Officer  (CO)  and  Contracting  Officer's 
Technical  Representative  (COTR) , in  writing,  when  any  of  the 
tasks  reach  a seventy  percent  (70%)  spending  level.  The 
contractor  shall  also  provide  a cost  analysis  of  the  remaining 
.unas  ana  time  requirements  that  show  the  remaining  funds  are* 
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To:  Finance  Frd.w.  Laboratory 

Re:  268~HQ~1092598,  06/16/2000 


LEAD (a)  i 

Sat  Lead  I (Ada) 

Big 


l*-1 


The  Finance  Division  is  requested  to  modify  Contract 
Number  J-FBI-0Q-Q80. 

Set  Lead  2 {Adit}  * 

CRIMINAL  INVESTIGATIVE 

AT  WASHINGTON.  DC 

To  approve  funding  for  requisition  number  827303  from 
budget  line  item  ETX122 . in  the  amount  of  $347,730,  modifying 
contract  J-FBI-00-080 


Set  Lead  3 (Mm) 

LABORATORY 

AT  OU ANTI CO . VA 
For  information  only. 


♦♦ 


'HSY.  5.2333  4 : 25PJ1 


DRAFT 


REQUEST  FOR  APPROVAL  OF  TESTING 
SIL£BI.„.EL^CTgMX-C_.SURVFILLARCE  EQUIPMENT 


fi— 


P.4 


SENSITIVE  ELECTRONIC  TECHNIQUE  INFORMATION  INCLUDED 

‘ DISCLOSE 

2 


S^Retejtse. 


***£€  £j*l 


OFFICE 


A^yJ^Departnttat  of  Justice 


Federal  Bureau  of  Investigation 


<" » ft!  ' 1,1  y , wVshtr.pco, D.  C,  20535*000 J ~~  ■— 

> JvW^C  kt  M 'Tie  -form.  <rt-^  mznm*  4ucS% 

Ht*u>  fvsm  fAc  hfhxAfr,  Hay  5,  2000  CLASSIFIED  8Y; J4HlcH 

5WU  fe-c  ^>&c^CT,  REASON:  1,5  fe.jj 

fa  KLO  _ OBOMmOUXtJ 

BEQUEST^ FOR  APPROVAL  OF  TESTING 
^SURVEILLANCE  E 


i urn  i 


iem 


ENSXTIVE  ELECTRONIC  SURVEILLANCeAhXIQVE  INFORMATION  INCLUDED 

BO  NOT<BX^lBs£  w 
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DRAFT 


REQUEST  FOR  APPROVAL  OF  TESTING 

lUCTRONIC  gURVEILLAKCS  EQUIPMENT  ^ 


HO. £29  P.5 


my.  5.2 


4:27PM 


^Xj 


kewtn  s^‘  he  Hmited  in  extent  and  duration  to  that  necessary  tn 

$wFaa!f CtP?,biiily  tbe  e?u5pment,  including  refinm®  th*nr*e4«irm  «#Vfc*  I~.s5!L„. 

testing  herein  shad  not  exceed  90  cays  without  the  i 
-ge«gne»-&f  the  Attorney  Qensfsl.  t^5  (*tj 

7»  O’f^ghl:  FBI  ID  testing  herein,  including  compliance  wnh  (he  oroce^ure*  «*  «%,»»,  J v 

herein,  shall  be  closely  monitored  by  the  FBI  LD’s  C&f  of  the  Cyber  TeclndogytectiS  £&*$) 


SENSITIVE 


ELECTRONIC 


SURVEILLANCE  TECHNIQUE  INFORMATION  INCLUDED 
DO  NOT  DISCLOSE 


May  12,  2000 


ssnwasiWB 

Director: 


haj?  ^ e ^ . 

CLASSIFIED  BY;  S*  »kP  I 
REASON:  t.S  ~(  c.  31^” 
OECUSSlFY  ON:  X If  # 


ng  t 
opos 
e Of 
nine 


Dr,  Kerr,  Room  3090 
Mr,  Allen,  QT  ERF 
Mr,  Thomas , QT  ERF 
T ERF 


^iLl 


approach.  Moreover,  the  LD  has  shared  with  the  DOJ's  Office  of 
Intelligence  Policy  and  Review  (OIPR)  a draft  of  the  attached 
proposed  memorandum  to  the  Attorney  General,  which  includes  the 
proposed  electronic  surveillance  testing  procedures.  OIPR 
supports  this  "testing”  approach,  as  provided  for  in  the  PISA 


, . (rouo)  If  You  approve  of  this  approach,  the  OIPR 

advises  that  the  FBI  request  should  be  forwarded  to  the  Attorney 
General  through  the  attached  memorandum,  which  the  OIPR  has 
already  approved  in  draft  form,  /{A 


Donald  M,  Kerr 
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Mrs.  Frances  Fragos  Townsend 
Counsel,  Office  of  Intelligence 
Policy  and Review 
Re 


(U)  The  Carnivore  software  has  been  developed  and 
tested  over  a period  of  years  and  has  been  deployed  in  the  field 
successfully  on  numerous  occasions.  However,  it  has  never  been' 
installed  in  the  USA.NET  network.  While  roost  networks  use 
standard  protocols,  protocols  can  vary  widely  from  the  standards 
in  some  networks.  ' - - 
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EXECUTIVE  SUMMARY 


TO;  THE  ATTORNEY  GENERAL 

THROUGH:  MRS.  FRANCES  FRAGOS  TOWNSEND 

COUNSEL,  OFFICE  OF  INTELLIGENCE 
POLICY  AND  REVIEW 

FROM:  LOUIS  J.  FREEH 

DIRECTOR,  FBI 

SUBJECT:  <U)  REQUEST  FOR  APPROVAL  OF  TESTING 

OF  FBI  ELECTRONIC  SURVEILLANCE  EQUIPMENT 

ACTION  MEMORANDUM 


:°  ofotain  Attorney  General's  approval  of  th* 

attached  FBI  electronic  surveillance  te^t-i-i^  •> 

testing  procedures  pursuant 

u.o  t\ ty  vc  steed.  in  chp  At&o^n^v  i e ^ " 

t-K„  r „ , an.o~ne>  General  in  Section  IQS(f)  of 

codified  SO  S:sxeni805maillanCe  ACt  °f  1978  <FISW  ' 

propose d^FB I ^Csrh*  Atcorn1ir  Seneral  is  requested  to  approve  the 
proposed  FBI  testing  procedures  as  soon  as  possible.  Testino 

pursuant  to  these  procedures  is  essential  for  the  FBI  to  be  ab'  ) 


ClassT?"^ 

DeclassiJ 


MAR  2 <>  7?  < 

CLASSIFIED  BY; 

REASON:  1.5  (cTTr^gi; 
DhCUS$IFyOM;X  f 


Sft^T 


5/24/02  Release  * Page  90S 


SEMET 


Memorandum  to  The  Attorney  General  from  Dir 


ector,  FBI 


RECOMMENDATION  i (U)  At  t g >~ri e v ^nr-mui  . * . 

, l~*'  «<-*■-- ^-nerax  approve  the  attached  fbt. 

electronic  surveillance  testing  procedures. 


APPROVE 


Concurring  com 


DISAPPROVE 


NONE 


)TKSR 


Nonconcnrri  na  component-  ■= 


NONE 


S&^ST 
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MEMORANDUM  for  the  attorney  general  DEOA 

THROUGH;  MRS.  FRANCES  FRAGOS  TOWNSEND 

p°^5L'  office  OF  INTELLIGENCE 
PoLI Ci  AND  REVIEW 

FROM;  Louis  J . Freeh 
Direct or , FB I 

SUBJECT;  (U)  REQUEST  FOR  APPROVAL  OF  TESTING 
J'  tBI  ELECTRONIC  SURVEILLANCE  EQUIP? 

ACTION  MEMORANDUM 


2 L>  zm  tint  , 

CLASSIFIED  BY:  j 

REASON:  1.5 
DECLASSIFY  OM:x1 


UIPMENT 


PU«POoH:  (U>  To  obtain  the  Atternav  General .« 

attached  FBI  electronic  survei^t  ce  ^ eipp^oval  of  the 

to  authority  vested  in  the  Atto-nL  rIC't“V^-?IOCe<3ures  Pursuant 
the  Foreign'  Intelli^ce  Section  105(f)  of 

codified  at  50  U.S.c  1805  {fH  1978  <FISA)  , 

TIMETABLE:  (Vf  The  ih--,™ 

proposed  FBI  ^stVnr/L  S7  '°enerai  13  requested  to  approve  the 
L.Jr  a thl  testing  procedures  as  soon  as  possible  P 


(U)  ClassTSs<ed  by;  G-3 
Dec  1 aam\  on ; x - 1 

SlJ^ET 
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SEjKtET 

Meinoxandtzni  £ x~ o n i Dirficto)*  itpt  ** ^ 

Rs  ■ RROttpct  crus  7t nri„  ' ^ ^ Attorney  General 

Re.  REQUEST  Pur  APPROVAL  OP  TESTING,  May  11,  2000 


SE^feT 

*4* 


Mm  Reh*se.togem 


SE<J^5T 

Memorandum  from  Director,  FBI  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  II,  2000 


that'  in  important  respects,  filters  and  then” 
Wlt?  9fe3u  precision  various  ISP  data  elements 

rert-A-ir,  of  c°nt®nfc  ^hen  authorized)  based  upon  reference  to 
ceitam  standardized  ISP  TCP/IP  protocols. 


tretJOj 


Non-ta 


un  ' L"!'*  ~ ’ . All  FBI  testina  sha 

Cst.  conaucted  in  sucli  3 w&v  tlist  iti  wi  1 1 nr^,h  +-  * v..._  _ f.  ^ 

- 1 . WXX1  noc  ^ targeted  jagamst 

the  communications  of  any  particular  person  or  persons . /if) 


{fa,  . ^FO/roJ  7*  Su.rat.ion:  The  testing  herein  shall  be 

limited  m extent  and  duration  to  that  necessary  to  determine  the 

the&eiu^y  °5  th»  e<*¥ipment'  including  refining^ the  precision  of 
the  equipment.  Testing  herein  shall  not  exceqd  90  days  without 
the  prior  approval  of  the  Attorney  General. 


. , (R0U&}  8.  Agency  Oversight:  FBI  LD  testing  herein 

including  compliance  with  the  procedures  set  forth  herein  «ha"i  3 
be  closely  monitored  by  the  FBI  LD's  Chief  of  the  Cyber  ' 
Technology  Sect  ion.  ||A 
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Memorandum  from  Director,  FBI  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  11*  2000 


Hr  QUO}  9-  Resorting : Upon  completion  of  the  testing 

herein,  the  FBI  LD  shall  submit  a summary  report  to  the 
Department  of  Justice's  Office  of  Intelligence  Policy  and  Review 
briefly  setting  forth  the  results  of  the  testing,  stating  its 
compliance  with  these  testing  procedures,  and  identifying  the 
duration  of  the  testing. J 

RECOMMENDATION:  Attorney  General  approve  the  attached  electronic 

curve ill ane e test i ng  p r oce du re s , 


APPROVE  

DISAPPROVE 

OTHER 


Concur r ina  component s ; 
NOME 

Noncononrrina  components ; 
NONE 
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Trom  : Director,  FBI 

Subject  ■.  (U)  REQUEST  FOR  APPROVAL  OF  TESTING 

OF  FBI  ELECTRONIC  SURVEILLANCE  EQUIPMENT 

ACTION  MEMORANDUM 


o 
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Memorandum  from  Deputy  Director  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  11,  2000 


Memorandum  from  Deputy  Director  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  11,  2000 
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Memorandum  from  Deputy  Director  to  The  Attorney  General 
Re:  REQUEST  FOR  AFPROVAL  OF  TESTING,  May  11,  2000 


m 


„ ...  ,etx njLvore  is  an  FBI-desiqne 

< nter^nt5r2f ^**1 ' in  f®P®^ant^respects,  filters  and  thin 
-intercepts  with  great  precision  various  ISP  data  elements 
1 including  content  when  authorized)  based  upon  reference  to 
certain  standardized  ISP  TCP/IP  protocols. 


k*  _ , » • t hGarJCargeuea  test  mg : All  FBI  testing  shall 

be  conducted  in  such  a way  that  it  will  not  be  targeted  against 
the  communications  of  any  particular  person  or  persons  («) 
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°epUty  Director  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  11,  2000 


“fr0UG)  7-  teafclon:  The  testing  herein  shall  be 

capability  T Sa  **•»*»•  *>» 

fcb«.  *>„„*. l>  ~ retin^ng  tne  precision  of 

c,  Cvjjj.pt, vent. . testing  Herein  snail  not  exceed  so  ' " 

h ftri  OV  ■>  <;■  . i A , / VvSyo  A’4,  b!  iOlit 

• ap^i oval  or  the  Attorney  General . (iA 


tf6W  8.  Agencx 
including  compliance  with  the 


be  closely  monitored  by 
Technology  Section. 


the 


£vg£Siai&2  FBI  LD  testing  herein, 
procedures  set  forth  herein,  shall 


■BI  LD*s  Chief  of  the  Cyber 


R8T;0 

shall 


rtinq : 
submit 


Upon  completion  of  the  i 
a summary  report  to  the 


nesting 


(FQUO)  9. 
herein,  the  FBI  LD 

Depaxtmenc  of  *3nst^  ce  * s ,*.,3  Ty.p « , *,  • . 

briefly  sett ing ‘ forth  the"results  of  the  ?es?ino°  icat^o 
compliance  with  these  testina  procedures  and  * tf 

duration  of  the  testing.^  P JrtS'  *ud  -^ntifymg  the 


SE^T 

16- 
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MEMORANDUM  FOR  THE  ATTORNEY  GENERAL  6/1/00 

THROUGH;  MRS,  FRANCES  FRAGOS  TOWNSEND 

COUNSEL,  OFFICE  OF  INTELLIGENCE 
POLICY  AND  REVIEW 

FROM-  LOUIS  J,  FREEH  fe 

DIRECTOR,  FBI  {j?K£HV/JS£  .C 

SUBJECT;  (U)  REQUEST  FOR  APPROVAL  OF  TESTING 

OP  FBI  ELECTRONIC  SURVEILLANCE  EQUIPMENT 

ACTION  MEMORANDUM 


attached  FBT^elSctro^S  ™<e f toiney  General's  approval  of  the 
to  authority  vested  in  f he' A-tor^v^®- r Pursuant 

coax fied  at  50  u*S.C,  1805(f)  ^JSA)  , 


attached  FBI 

h Ci  vf  V,  y-x  w 4 v.  » . 


TIMETABLE:  (X  T h«  , , 

pxoposea  FBI  lestina  nroeedm^  4 > a to  approve  the 

“iire»a^f  ^ p^Q^eauxes  e«s  soon  as  possible 

ursuant  to  these  oro cednrpss  ^ *. 

he  FBI 


8P*HQ-X0X24» 


, Roor 

ft  714 

2 

Room 

■ 

| iioom 
[ Room 
1 Root 

ii>  *1 

Room 


— - — — f ^oom  3090 
Mr.  Allen,  qt  erf 
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Memorandum  from  Director  fpt 

Re:  REQUEST  FOR  APPROVAL  OF  TESTING  ®Y  General 


. progr^rT^^^^^S^respecCs6  m??  FBi "design^ 

intercepts  with  great  precision  vari^f  filters  and  then 

{including  content  when  a„H,A  . aixoua  ISP  data  elements 

certain  standardised  ISP  TCP/lpSJ?otScolf . UP°U  reference  to 


(FOOD)  4.  Mon^arcetedtestinc-  an  rat 
be  conducted  in  such  a waTThSTi^^^t t I sha11 

the  communications  of  any  particular  rw’r-^n  targeted  against 

y Particuiar  person  or  psrsonsAf. 


limited  in  ^extent-  ~ testing  herein  shall  be 

capabilitv  of  o duration  to  that  necessary  to  determine  H,a 

the  S,h  £L  5 ht  ec^pment,  including  refining  the  mSlSt  *5® 
tne  equipment.  Testing  herein  *1  § cne  Precision  of 

the  prior  approval  of  the  Attorney  GeSSarg®  90  days  without 
including  SSuance^ith^hl^^Sure^ec^fo???1?3  h?rBin' 

JtfiSSg  che  ra?  “r*  Chiefs  ’ 'shc!s:“' sha11 
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herein,  the^FBl ' LD  * , ^pon  completion  of  the  test inq 

gepart^nt  <*  JuSice-sMHof  of  SESfJZSto&J?*  - , ” 

duration  of  the  testing  (gj  P d 1 £,f  an<i  identifying  the 

?u-SJ???DATZON:  Attorney  General  approve  the  attached  *. 

surveillance  testing  procedures.^  jl  attached  electronic 


approve 
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